Unsupervised anomaly detector that flags early breach precursors (credential dumping, process injection) using Isolation Forest on EDR-style process features. Inspired by CrowdStrike-style EDR — includes confidence gating and human-readable explanations—deployed on Streamlit Cloud.

Wazuh SIEM lab detecting lsass credential access using Sysmon Event ID 10 and a custom rule targeting PROCESS_ALL_ACCESS (0x1FFFFF). Built in Proxmox homelab.

Java program simulating ethical brute-force password attacks for cybersecurity practice.

Threat hunt for brute force login attempts against internet-exposed VMs using Microsoft Defender for Endpoint and KQL. Maps findings to MITRE ATT&CK T1110.

# LSA Secrets Dumper - Windows Security Research Tool

Simulated RDP brute force from Kali to Windows with Splunk detection, MITRE ATT&CK mapping (T1110), alerting, and defensive hardening.

This repository contains a complete, analyst-grade walkthrough of the PoisonedCredentials lab form CyberDefenders, focusing on LLMNR/NBT-NS poisoning and network forensic analysis using Wireshark