Pentest Lab: Recon (Nmap) + DAST (OWASP ZAP baseline/full) against OWASP Juice Shop with reproducible HTML/TXT/PNG evidence and optional SOC correlation.

Personal SOC lab using T-Pot CE on AWS to analyze real-world attack telemetry through Honeypots, Suricata, and offline log analysis

Practical SOC detection engineering and incident response case studies, including SIEM/XDR detections, alert triage, and malware analysis.

SOC-style ransomware investigation using KQL (Azure Data Explorer)

Command-line (proctitle) classification into MITRE ATT&CK techniques using TF-IDF + Logistic Regression and an LSTM baseline, with a custom token pattern tailored for cyber artifacts (IPs, paths, flags, URLs).

Wireless Zero Trust threat detection and response lab using Python and Scapy, with MITRE ATT&CK mapping and SIEM-style logging.

Enterprise Active Directory security lab focused on privileged access hardening, audit policy configuration, detection engineering, and incident response. Simulates unauthorized privilege escalation attacks with forensic log analysis and MITRE ATT&CK mapping.

Behavior-based Linux malware profiler: ptrace syscall tracing → JSONL events → heuristic analysis with IOC extraction & MITRE ATT&CK mapping. No signatures, no hashes

EDR/XDR detection coverage, gaps, and governance considerations for enterprise environments

SOC triage tool to enrich Windows command-line logs with MITRE mapping and analyst context