AD chains, web exploitation, Linux pivots — written up in ctf-writeups with methodology over flags.
open · security engineering · detection · controlled testing · Morocco / EU / remote
Yassir Zahidi
Cybersecurity engineer-in-training · detect+test+harden
I build detection and forensic systems, exercise them in authorized scenarios, and turn observed gaps into stronger controls. Wazuh + Suricata + Sysmon + MISP + FortiGate form the lab spine; evidence drives the next engineering decision.
0security case files
0cybersecurity certifications
0incidents triaged at ALTEN N1/N2
0SIEM deployment completed
0to spin up the SIEM lab
01. About
Engineering student in Morocco with a Specialized Technician diploma in Cybersecurity already done. Most of what I know about security I learned by deploying it — then trying to break what I just deployed. Reading about it came last.
The defensive side I built for real: a multi-layer SIEM in an authorized ministry-network environment during a one-month security internship in May 2024 — Wazuh + Suricata + Sysmon + MISP + VirusTotal integrated with a FortiGate firewall, with Nessus scans on top. The reproducible lab version is on this site, packaged as a docker-compose project so anyone can spin it up in three minutes.
I sharpen controlled-testing skills in TryHackMe / HackTheBox / OSCP-track labs and inside my own lab segment — web exploitation, Active Directory paths, and post-access analysis. Atomic Red Team helps turn each observed gap into a new Wazuh rule and a documented hardening step.
On the dev side I've shipped a few full projects (a billing system in C++, a WordPress site, a BI/data-warehouse on Moroccan water stress, an interactive HTML/CSS course platform). They're not rocket science — they're shipped, documented, and they work.
What I'm looking for: a security engineering internship where I can ship detection, forensic, validation, or hardening work that survives review.
02. Case study — SIEM in an authorized ministry-network environment
May 2024. One month, on site, in an authorized ministry-network environment. Below is what was actually built and what shipped to production. The reproducible lab version is the home-lab-siem repo.
Endpoints (Win/Linux) Network perimeter
│ Sysmon → Wazuh agent │
│ │ FortiGate (syslog)
│ │ Suricata IDS (EVE JSON)
▼ ▼
┌──────────────────────────────────────────┐
│ Wazuh manager · Wazuh indexer (OS) │
│ Decoders · rules · alerts │
│ MISP — IoCs/feeds │
│ VirusTotal — hash/file enrichment │
│ Nessus — weekly vuln scan │
└───────────────────────┬──────────────────┘
▼
Wazuh dashboard · SOC views
MITRE ATT&CK mapping · hunts
What I actually wrote, in detail
Detection
- Custom Wazuh decoder + rules for FortiGate
trafficandeventlogs (failed VPN, geo-anomaly, admin login outside hours). - Sysmon channel pulled in via the Wazuh agent on Windows endpoints (process create / network connect / image load).
- Suricata in IDS mode, EVE JSON tailed by Wazuh → alerts mapped to MITRE ATT&CK techniques.
Enrichment
- MISP feeds (CIRCL, Abuse.ch) syncing IoCs every 6h; Wazuh integration script tagging alerts with matching threat-intel hits.
- VirusTotal v3 API for hash + URL lookups on suspicious download alerts.
Vulnerability management
- Nessus authenticated scans on the Windows fleet, weekly cadence, results piped into the Wazuh vulnerability module.
- Initial penetration tests inside the lab segment — documented findings and remediation.
What I would change next time
- Atomic Red Team for continuous detection validation (now in the lab repo).
- SOAR layer (TheHive + Cortex) to formalise incident handling.
- Sigma-rule pipeline so detections aren't tied to one engine.
03. Detection coverage
What the lab actually catches, mapped to MITRE ATT&CK. Hover any technique to see the rule that fires. Green = covered by a rule I wrote, dim = next on the backlog.
Sources: home-lab-siem Wazuh ruleset + Suricata signatures. Coverage rebuilt every time I add a rule — not aspirational. Every “covered” cell has a corresponding authorized validation test in the validation loop.
<rule id="100210" level="10">
<if_group>authentication_failures</if_group>
<same_source_ip />
<same_user />
<different_geoip />
<description>Impossible-travel sign-in: same user, two countries < 1h</description>
<mitre>
<id>T1078</id>
<tactic>Initial Access</tactic>
</mitre>
</rule>04. Controlled testing
Authorized testing is how I challenge the same architectures I build. Recon → enumeration → controlled access → privilege review → evidence → remediation. Every finding becomes a documented control improvement.
-
01
Recon
passive + active enum on the target perimeter, identify the soft side.
nmap · masscan · subfinder · amass · gowitness · whatweb · shodan -
02
Initial Access
web exploitation, exposed services, password spray, controlled phishing in lab.
burp · ffuf · sqlmap · spray · cve-* · phishing-template -
03
Foothold
get a stable shell, drop tooling, baseline the host.
msfvenom · python-revshell · evil-winrm · nc · chisel -
04
Priv-Esc
local enum scripts, GTFOBins / LOLBAS, kernel CVEs, AD misconfig.
linpeas · winpeas · GTFOBins · LOLBAS · BloodHound -
05
Lateral / AD
impacket toolkit, Kerberos abuse, PtH/PtT, abuse-able trusts.
impacket · crackmapexec · rubeus · mimikatz · kerberoast · PtH -
06
Loot → Evidence
credential dump, evidence pack, IOC list — then handed back to the SIEM.
secretsdump · evidence-pack.md · ioc.csv → wazuh · misp
Buffer-overflow refresh, Active Directory attack paths, manual exploit dev. Targeting OSCP within the next certification cycle.
I run my own home-lab-siem stack as the target — atomic-red-team campaigns + manual chain attempts. Findings feed the next sprint of detections.
Working notes I keep close — recon → enum → AD → web → post-ex. Not a copy of someone else's gist.
05. The validation loop
Where observation becomes engineering. Each controlled finding becomes a detection or hardening change, and each new control is re-tested to confirm that it produces useful evidence.
- 01
Hypothesise
Pick a TTP from MITRE — say T1003.001 (LSASS dump). Find the gap in current detections.
- 02
Emulate
Fire the technique against the lab using
atomic-red-teamor a manual exploit chain. - 03
Observe
Did Wazuh / Suricata catch it? At what level? With what false-positive rate?
- 04
Tune
Write or refine the Sigma / Wazuh rule. Keep alert noise low; keep coverage honest.
- 05
Re-fire
Run the test again. Confirm the alert fires & that no benign workload is now noisy.
- 06
Document
Push the rule + the test + the writeup to
home-lab-siemandctf-writeups.
22atomic-red-team tests in rotation
14sigma rules authored
8finding→control closures shipped
~24htypical loop time
Concrete example — LSASS-dump closure
Hypothesis: if a controlled lab operator reproduces an LSASS access path via comsvcs.dll, current rules might miss it (no .exe touches lsass.exe).
Emulation: Atomic Red Team test T1003.001 → atomic-2 — rundll32 comsvcs.dll, MiniDump <pid> out.dmp full.
Observed: sysmon Event 10 fires (process access lsass.exe), but base wazuh ruleset only flags Event 1 by image name. Miss.
Tune: wrote rule 100620 matching Event 10 + granted_access mask 0x10|0x1410|0x1010 on lsass.exe.
Re-fire: alert level=14, MTTD <30s, no false positives over a week of normal workload.
Documented: rule + atomic test + screenshots in home-lab-siem/docs/closures/T1003.001.md.
06. Detection compiler live · browser tool
Type a Sigma rule on the left. It is translated live — in your browser — to Wazuh XML, Splunk SPL, KQL / Microsoft Sentinel, and Suricata. Pure JS, ~280 lines of pattern-matching, zero backend, zero telemetry.
07. Security case files
The primary portfolio evidence: architecture, telemetry, controlled scenarios, forensic context, and the engineering decisions that follow. Full implementations remain private where appropriate.
01 / flagship case file
architecturetrust boundariesforensic signal
From deceptive surface to forensic signal.
A platform design that connects deception, intelligence correlation, forensic context, and controlled validation without exposing private source code.
ScopeCyberdeception · DFIR · CTI
ProofArchitecture · trust boundaries · sanitized patterns
OutcomeObserved gaps become reviewable engineering decisions
Detection lab
home-lab-siem
Reproducible SIEM lab built around a real-world ministry-network deployment.
Wazuh, Suricata, Sysmon-ready endpoints, FortiGate, Nessus, MISP, and MITRE ATT&CK mapping are presented as a repeatable evidence and hardening workflow.
ctf-writeups
Authorized lab analysis focused on method, observability, and control implications.
Writeups turn recon, enumeration, access paths, privilege review, and lessons learned into reusable security reasoning.
pentest-cheatsheet
A maintained reference for authorized security learning and controlled testing.
Recon, web, Active Directory, privilege review, and post-access notes are organized as a practical study system rather than a copy-paste dump.
Broader systems work
Supporting repositories demonstrate full-stack delivery, data engineering, accessibility, business workflows, and Linux operations. The water-stress warehouse contains 68k records; it stays here as proof of broader systems delivery, not as the primary security signal.
HTMLCamp · water-stress-morocco-analytics · FacturationPro-Enterprise · Rabat Cultural Website
08. Current work
A compact view of the controls, scenarios, and supporting systems currently on the workbench.
This week
- validate Atomic Red Team validation pack against the lab Wazuh rules — detection coverage report.
- detect MISP
misp-moduleswired in for hash + URL enrichment and triage context. - test Writing up two authorized lab paths (Active Directory chain + Linux pivot) for the writeups repo.
This month
- test OSCP-track lab time — buffer-overflow refresh and Active Directory attack paths.
- detect Sigma rule pipeline so the lab's detections are portable beyond Wazuh.
- dev Polishing the C++ billing app (FacturationPro) for a 1.0 cut — PDF templates, multi-user.
This quarter
- Internship applications — security engineering · detection · controlled testing, remote / EU / Morocco. open.
- CCNA Security track — finishing labs, scheduling exam.
- Open-sourcing one detection-engineering write-up and one offensive write-up per month.
09. Achievements
Milestones across deployment, detection, controlled testing, and validation. Solid line is shipped; dashed line is in progress.
SIEM in production
Multi-layer Wazuh + Suricata + Sysmon + MISP + FortiGate stack deployed in an authorized ministry-network environment — 1 month, real network.
13 cybersec certifications
Fortinet NSE 1–3, EC-Council, ICSI, CCNA-track, Google IT Support, Linux Essentials, and more.
50+ tickets at ALTEN
N1/N2 incident triage — ticket lifecycle, runbooks, escalation path. Real users, real pressure.
OSCP-track
Buffer-overflow refresh, AD attack paths, manual exploit dev — in active prep.
HTB / THM rooms cleared
AD chains + Linux pivots + web exploitation. Writeups in ctf-writeups.
pentest-cheatsheet — published
Public, opinionated, kept current.
Atomic-Red-Team validation
22 tests in rotation against the home-lab-siem rules — every covered cell has a matching test.
Sigma rule pipeline
Detections decoupled from Wazuh alone — portable across Splunk / Elastic.
finding→control closures
8 closures shipped, 6 more in the backlog. Goal: one new closure per week.
10. Detection-engineering activity
Rules shipped, atomic tests run, closures documented — week by week, full year. Hand-rolled SVG, hand-curated data. Hover a cell to see what shipped that week.
0contributions · last 52 weeks
0current streak (weeks)
0best week
0median per active week
11. Stack
Detection & telemetry
- Wazuh
- Suricata
- Sysmon
- MISP
- VirusTotal
- FortiGate
- Nessus
- Sigma
- MITRE ATT&CK
Controlled testing
- Burp Suite
- Nmap
- Metasploit
- BloodHound
- Mimikatz
- Impacket
- CrackMapExec
- OSCP path
Validation & portability
- Atomic Red Team
- Sigma pipeline
- Caldera (study)
- Detection-as-code
Network & system
- FortiGate VM
- Cisco (CCNA-track)
- VLANs / IPSec
- Linux (Ubuntu / Debian)
- Windows Server
- Active Directory basics
Dev
- C / C++ (VCL, RAD Studio)
- PHP
- HTML / CSS / JS
- SQL (MySQL)
- Bash
- Python (basics)
DevOps / data
- Docker / Compose
- Git / GitHub
- QlikView
- WordPress
- Monaco editor
- VMware Workstation
12. Certifications
13 certifications — kept current, all with verification links on LinkedIn.
Fortinet NSE 1–3
FortinetCertified Ethical Hacker (CEH essentials)
EC-CouncilICSI | CNSS — Cybersecurity Specialist
ICSICCNA — Routing & Switching track
CiscoGoogle IT Support
GoogleLinux Essentials
LPINetwork Defense Essentials
EC-CouncilCybersecurity Bootcamp
Diverse providers13. Get in touch
Recruiting, internship, security side-project, want a second pair of eyes on a SIEM rule — drop me a line.