In my personal lab and practical case studies, I built a Windows and Active Directory environment with pfSense and centralized Windows Security and Sysmon logs in Splunk. I used SPL queries to correlate logons, processes, network connections, and DNS activity during investigations.
For a Windows Defender disabled investigation, I reconstructed a timeline of privileged account creation, Defender deactivation, malware execution, and scheduled-task persistence. I documented the evidence, investigation limitations, and recommendations for isolation, control restoration, and remediation.
In an external RDP activity investigation, I correlated connections to port 3389 with successful administrator network logons using Sysmon and Windows Security. I identified activity requiring authorization validation and recommended escalation and a credential reset if access was unauthorized.
I have a Bachelor’s Degree in Information and Communication Technology from Universidad Iberoamericana (UNIBE), with a Cybersecurity Concentration. My certifications include CompTIA Security+ and Blue Team Level 1 (BTL1), and I completed the MYDFIR SOC Analyst Course.
