Cybersecurity
Disable Botnet
October 2020
- Accessed the command and control server of a group of hackers to disable a botnet network in use to execute a widespread financial scam triggering the collapse of a national bank.
- Scan the command & control server located at myloot.com for running services, identify a vulnerable service, and perform a brute force attack to obtain credentials.
- Killed the web server acting as the command and control orchestrator.
Skills: Network Protocols, Reconnaissance/Enumeration, Password Cracking, Exploration, and Remote Administration.
Stop Malicious Processes
October 2020
- Analyzed network traffic and stopped a malicious exfiltration process utilizing HTTP and TCP for a tunnel, malicious DNS and IP addresses, process names, and pass-the-hash lateral movement.
- Captured traffic from the firewall, found and stopped data exfil of credit card and encrypted data.
- Removed all artifacts of the infection and prevented the reinfection of the malicious processes.
Skills: Application layer networking, Linux command line interface, packet capture, process analysis, and containment and eradication of malware.
Respond to Phishing and Exfil
October 2020
- Conducted a risk assessment of a company’s existing network structure and its cyber risk posture for possible phishing attacks.
- Analyzed threat vectors used in Saudi Arabia Aramco and Doha RasGas cyber attacks.
- Review any detectable weaknesses to ensure no malicious activity is occurring on the network currently.
Skills: Incident response team processes, Windows and *nix systems administration (Active Directory, Group Policy, Email), Network monitoring (Snort, Bro, Sguil)
Full Stack Network Project