Bence User

I built a Python-based Windows EVTX detection engine that identifies suspicious activity in event log data. Its behavioral rules cover Sysmon and PowerShell events, including LOLBin execution, AMSI bypasses, and credential harvesting.

For my EML phishing detection engine, I implemented MIME header parsing to inspect SPF, DKIM, and DMARC results. I also added HTML analysis to detect hidden keyword stuffing, evasion strings, and mismatches between displayed links and URL targets.

In my phishing email and OSINT investigations, I identified technical and social-engineering indicators, mapped observed techniques to MITRE ATT&CK, and documented findings in an analyst report. I also investigated the origin and infrastructure behind a phishing attempt and a compromised OSINT tool used as a malicious redirect.

At MPE OCM, I planned and coordinated content and communication strategies for an organization reaching 1M+ users monthly across social platforms. At Younited, I coordinate initiatives, events, and strategic planning for a youth-focused nonprofit.