Lab Setup & VM Onboarding (May, 2026)

I did have a previous connected vm, but I made a completely new one as I moved from Hyper-V to my familiar Oracle Virtul Box and Documented that onboarding.

 Descriptions Below Screenshots

Atomic Red Team Simulation & Detection (May, 2026)

Objective: Generate realistic threat telemetry to test and validate Defender’s out-of-the-box and custom detection logic.

• Preparation: Configured an intentional Antivirus/ASR exclusion path for the C:\ directory housing the Atomic Red Team framework. This ensured Defender would not preemptively quarantine the execution scripts before the tests could run.

• Adversary Emulation: Deployed targeted simulations mapped directly to the MITRE ATT&CK framework, specifically executing Persistence (T1547.001) and Credential Access (T1555) techniques.

• Outcome: The simulations successfully executed, generating the necessary telemetry to trigger a multi-stage incident within Defender for triage and analysis.

Email Header Analysis -  Cloud Storage Phishing Email leads to credential harvesting & potential identity theft

Objective To conduct a comprehensive analysis of a suspicious "Billing Failure" email by analyzing raw SMTP headers to identify the originating infrastructure, and securely detonating the embedded payload within an isolated sandbox environment to map the complete attack chain and adversary objectives.

Context An unsolicited email was received claiming a 2TB "Premium Cloud" subscription payment had failed. The message leveraged high-pressure social engineering tactics, stating the account was in "Pending Deletion" and threatening permanent, irreversible data loss if payment details were not updated within 24 hours. The email lacked any specific branding from a legitimate cloud provider.

Phase 1: Static Header Analysis

An inspection of the raw email headers revealed several classic indicators of burner phishing infrastructure and defense evasion techniques:

Phase 2: Static Header Analysis

An inspection of the raw email headers revealed several classic indicators of burner phishing infrastructure and defense evasion techniques:

• Sender Obfuscation: The "From" address utilized MIME Encoded-Word syntax (=?UTF-8?...) to obscure the display name. This technique is deliberately used by threat actors to blind basic string-matching spam filters that might flag keywords like "Cloud Storage Alert."

• Infrastructure Tracing: The first external hop (95.154.235.136) originated from Iomart Managed Services (RapidSwitch), a commercial data center in the UK. This indicates the adversary utilized a rented Virtual Private Server (VPS), VPN or compromised cloud infrastructure to launch the campaign, rather than a residential IP.

• Authentication & Domain Age: While the email passed DKIM and DMARC checks, it failed SPF. Further OSINT investigation into the sending domain (rveband.com) revealed it was registered only three months prior. The primary domain in the redirect chain was created four months prior, a strong indicator of disposable attacker infrastructure.

Phase 3: Dynamic Payload Detonation & Attack Chain Mapping

To safely observe the email's behavior and the attacker's ultimate goal, the embedded URL was extracted and detonated within a secure, isolated cloud browser session in this case, ("browser.lol" for free analysis).

The analysis revealed a sophisticated, multi-stage redirection scheme, designed to potentially harvest credentials, financial data and identity:

• Stage 1 (Intermediary Redirection): The initial link routed to a domain named prizeswin.com. This page executed a fake "verification" script (displaying checks for Location, User Info, and Entry Status) to build a false sense of legitimacy.

• Stage 2 (The Lure): The session was then redirected to secure.totaldrive.com. The page displayed a fraudulent offer for discounted cloud storage services, prompting the user to check out via a prominent PayPal button.

• Stage 3 (Credential Harvesting): Clicking the payment button initiated a redirect to a highly convincing, spoofed PayPal portal. The site was engineered to capture data regardless of user action; both the "Sign In" and "Create an Account" workflows immediately prompted the victim for Personally Identifiable Information (PII), billing addresses, and full bank/credit card details.

• Conclusion This campaign demonstrates a well-orchestrated credential harvesting operation. By combining psychological urgency with obfuscated routing and multi-stage redirects, the adversary aimed to bypass email security gateways to commit identity theft and financial fraud.

Custom Analytic Rule & Detection (March 2026)

Objective: Engineer custom detection logic to capture specific activities and rapid-fire events for lab testing and analysis.

• The Context: Out-of-the-box alerts are foundational, but custom analytic rules are critical when hunting for zero-day threats or tailoring detections to specific organizational contexts.

• Rule Engineering: Developed custom KQL-based analytic rules in Sentinel to monitor targeted events, such as frequent browser downloads and routine account sign-ins.

• Enrichment: Mapped the detection logic directly to relevant MITRE ATT&CK tactics and configured strict Entity Mapping (Users, Hosts, IPs) to ensure the resulting alerts were populated with structured, actionable data for rapid triage.

Initially, I need some rapid alerts so I created some custom alerts for browser downloads and any account sign-in attempts.

Basic PlayBook Automations via Logic Apps in Sentinel (March, 2026)

Objective: Implement basic Security Orchestration, Automation, and Response (SOAR) workflows to reduce manual triage fatigue and accelerate incident response times.

• Workflow Orchestration: Utilized Azure Logic Apps—a cloud-based platform for orchestrating processes without extensive code—to build Microsoft Sentinel Playbooks.

• Dynamic Alerting: Configured playbooks to automatically extract dynamic incident details (Alert Title, Severity, Entities) and push them via webhook to Microsoft Teams and Outlook, allowing for immediate, at-a-glance triage before even opening the SIEM.

• Auto-Remediation Testing: Engineered an automation rule to automatically close known-benign incidents generated by my custom "Any Account Sign-In" lab rule, successfully demonstrating automated noise-reduction techniques.

I need to practice some more, but I wanted to get initial hands-on experience about automating these and its capabilities. 

Conditonal Access Policy Test (May, 2026)

Objective: Test Zero Trust access controls and evaluate how identity signals are processed to prevent unauthorized access.

• The Framework: Conditional Access functions as an intelligent "if-then" gatekeeper, evaluating real-time signals (identity, device health, network location) before granting access to resources.

• Execution: After disabling baseline security defaults, I configured a custom block policy targeting authentications originating from a specific "Named Location" (Germany). I then routed my connection through a German VPN node and attempted to authenticate into Outlook.

• Outcome: The authentication was successfully blocked post-credential entry. This demonstrates how conditional access mitigates risks like Adversary-in-the-Middle (AiTM) attacks or stolen session cookies by enforcing environmental constraints regardless of valid credentials.

• Detection Bonus: The rapid shift in geography between my actual location (United States) and the VPN node (Germany) successfully triggered a custom "Impossible Travel" analytic rule I had previously engineered in Sentinel.

Azure Sentinel Workbooks

Objective: Build dynamic, visual dashboards to accelerate threat hunting and log analysis by transforming raw SIEM telemetry into actionable intelligence.

• The Framework: Azure Workbooks provide a highly flexible canvas for complex data analysis and visual reporting directly within the Microsoft Sentinel environment.

• Dashboard Engineering: Instead of manually querying raw logs for every investigation, I made custom workbooks to visualize security metrics. Specifically, I developed dashboards tracking ActionTypes within DeviceEvents and aggregated event counts for broad Windows SecurityEvents.

Configuring Email Policies & Threat Protection

Objective: Harden email infrastructure against phishing campaigns using Defender for Office 365.

• Visibility & Tracking: Utilized the Email & Collaboration Threat Explorer to monitor the environment, gaining deep visibility into user clicks, quarantine statuses, and phishing campaigns.

• Policy Engineering: While standard protections provide a baseline, advanced threats require custom rules. I engineered a tailored Safe Links policy (ebpracticelab-safelink) designed to proactively rewrite and neutralize suspicious URLs, effectively neutralizing malicious links before a user can compromise their endpoint.

• Live Testing: Emulated an external threat actor by sending a sample scam-themed email containing a test link. The engineered rules successfully detected the anomaly and routed the threat directly to the junk folder.

• Posture Hardening: Leveraged the Configuration Analyzer to audit the current email environment against strict security baselines, systematically applying recommended actions to continuously strengthen the perimeter.