Projects on Talal Ahmed

Home SOC Lab: Detection, Firewall Telemetry, and Alert Automation

Wed, 15 Apr 2026 00:00:00 +0500

Overview

This lab brings endpoint telemetry, firewall events, and alert delivery into one practical SOC workflow. Wazuh provides centralized monitoring, pfSense adds network-level visibility and control, Sysmon enriches Windows process data, and n8n forwards higher-priority alerts to Discord.

The environment was validated with file-integrity tests and a controlled malware exercise. The malware report describes the sample as Zeus while recording a Windows Defender identification of TrojanDropper:Win32/Sirefef.gen!B; this case study preserves that distinction rather than treating the family attribution as independently confirmed.

WannaCry Malware Analysis

Fri, 13 Mar 2026 00:00:00 +0500

Overview

This analysis examined a WannaCry sample with static inspection and interactive sandbox observation. The work focused on what the binary appeared capable of, which behaviors were observed at runtime, and how those findings translate into defensible detection and response actions.

SHA-256: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
Target: Windows 10 Professional, build 19044, 64-bit

Objectives

Identify meaningful strings, imports, and other static indicators.
Observe the process tree, filesystem changes, registry activity, and network behavior.
Correlate static capabilities with runtime evidence.
Produce detection, containment, eradication, and recovery actions grounded in the observed sample.

Environment and architecture

The local target was a Windows 10 guest in VirtualBox with a host-only adapter to prevent access to the physical host or external network. A clean snapshot and Regshot baseline were created before execution.

Automated SRS Generator