Write-ups | Mojalefa L. Letsoara

Conti Ransomware Investigation, Splunk SIEM Threat Detection

A full SOC investigation into a Conti ransomware compromise of a Microsoft Exchange server: 28,145 events analysed in Splunk 8.2.2 across Windows Security, Sysmon, IIS and Exchange logs. The attack chain ran from three exploited CVEs (CVE-2020-0796, CVE-2018-13374, CVE-2018-13379) through a trojanised cmd.exe and a deployed web shell, to credential harvesting and LSASS injection, with an 11-day attacker dwell time before detection. Written up as a 24-page technical report with 24 annotated screenshots.

Splunk
Log Correlation
Incident Response
Sysmon
MITRE ATT&CK

View on GitHub

Threat Detection & Log Analysis Using Splunk SIEM

A Tier 1 SOC investigation simulation: 112 Apache access log entries ingested into Splunk and analysed with 9 custom SPL queries, surfacing 14 HTTP 500 errors and 4 successful DELETE operations against /api/users across 112 unique IPs. Documented as a formal P1 incident report with prioritised remediation recommendations.

Splunk
SPL
Log Analysis
HTTP Forensics

View on GitHub

Legacy Account Recovery, ATO Case Study

A SOC case study on identity-based attacks inspired by the 2013 iCloud breach. Maps a full account-takeover attack chain to MITRE ATT&CK and NIST, phase by phase, then writes a SOC detection rule for each phase rather than stopping at the description of the attack.

MITRE ATT&CK
NIST
Identity Security
Threat Modeling

View on GitHub

MailShield SOC & SOAR Lab

Enterprise email security work covering synthetic email analysis, Splunk detection engineering, IOC enrichment against AbuseIPDB, VirusTotal and Talos, CyberChef decoding, risk scoring and incident closure. I deliberately left risk-score discrepancies visible in the output rather than tuning the project to produce an expected result, since the point was to expose the model's actual limitations, not hide them. Shuffle automation is the current area of active development on this one.

Splunk
IOC Enrichment
Risk Scoring
Shuffle

View on GitHub

File & Hash Threat Intelligence Analysis

Practical malware triage and threat intelligence work using VirusTotal, MalwareBazaar and Hybrid Analysis: SHA256 verification, static analysis with BLint, sandbox analysis, IOC extraction and MITRE ATT&CK mapping. Case samples examined include BlackMoon, IcedID, a double-extension social engineering payload, and Akira ransomware.

VirusTotal
MalwareBazaar
Static Analysis
MITRE ATT&CK

View on GitHub

Malware Analysis Field Guide, Static, Dynamic & Threat Hunting

A working intake-to-report methodology: hash verification, magic bytes, strings and entropy checks, import table review, then dynamic analysis with ProcMon, Wireshark and Any.Run, YARA rule writing, IOC extraction and documentation, and threat hunting off the back of it.

YARA
ProcMon
Wireshark
Any.Run

View on GitHub

TryHackMe Write-ups

A running collection of DFIR, malware analysis, memory forensics and reverse-engineering write-ups, worked from a SOC analyst's perspective rather than a pure CTF angle.

DFIR
Malware Analysis
Memory Forensics
Reverse Engineering

View on GitHub

A Scandal, KC7 Cyber

A KC7 investigation exercise built around attacker behaviour, event correlation and end-to-end incident analysis using KQL.

KQL
Event Correlation
Incident Analysis

View on GitHub

All Repositories on GitHub

Alert to investigation.

Let's put this to work in your SOC or cloud team