Ian's CV

Security Portfolio:

Building a Very Basic Info Stealer

06/2024

Curious about info stealers, and the process of stealing and utilizing stolen cookies, I decided to build and deploy an infostealer in python. I explain the code, the deployment, and lessons learned.

Python
Malware

Deploying Elastic in a Homelab

05/2023

I deployed Elastic and Kibana as a SIEM solution, utilizing Elastic Security, the default rule set, and the Elastic Agent.

Elastic
SIEM
Homelab

Elastic Security Ransomware Experiment

06/2023

In my homelab, I utilized a python ransomware builder, RaaSNet to build a payload and C2 server. I executed this payload, and automated the parsing of relevant Elastic logs, as well as writing custom detection rules for the ransomware.

Elastic
Ransomware
Python
Javascript

Elastic Custom Correlation Rules

08/2023

I rewrote a default detection rule in Elastic Query Language (EQL) to allow for a more specific tune. This utilizes Elastic Query Language, different from KQL or ES|QL, to allow for wildcards in file path and name. The results were then tested with a PowerShell script.

Elastic
Rule Detection
EQL
PowerShell

Older Work: