🎯Flagship
Enterprise Security Monitoring Platform
Multi-SIEM production platform: Splunk Enterprise + Wazuh XDR + Elastic Fleet + Security Onion on Proxmox VE. 500+ endpoints, 100+ servers, <2 min MTTN.
View Case Study →SOC Analyst & SIEM Engineer at PostEx (Fintech) — building and operating enterprise security monitoring infrastructure using Splunk Enterprise, Wazuh, Elastic Fleet, and Security Onion across 100+ servers and 500+ endpoints. Detection engineer with 40+ MITRE ATT&CK-mapped rules. TryHackMe Top 1%.
I’m a SOC Analyst & SIEM Engineer (titled Assistant Manager – Data Center) at PostEx, a high-volume fintech and logistics company in Lahore, Pakistan. Over the past 3+ years I’ve designed, deployed, and operated the full enterprise security monitoring stack — from initial log ingestion to detection rule engineering and incident response.
My daily work involves operating a multi-SIEM environment: Splunk Enterprise for log aggregation and SPL-based detection, Wazuh for XDR/HIDS across 500+ endpoints, and Elastic Fleet with Elastic Defend for EDR across 100+ cross-platform servers. I’ve built 40+ MITRE ATT&CK-mapped detection rules and reduced false positive rates by 40% through systematic tuning.
Beyond SIEM work, I design network security architecture, manage MikroTik and Cisco infrastructure, run vulnerability assessments using OpenVAS and Nmap, and conduct web application security testing. I’m a TryHackMe Top 1% ranked practitioner and actively practice offensive security skills.
Multi-SIEM production platform: Splunk Enterprise + Wazuh XDR + Elastic Fleet + Security Onion on Proxmox VE. 500+ endpoints, 100+ servers, <2 min MTTN.
View Case Study →Full Splunk production deployment: core router, WAN, Windows/Linux log collection, syslog aggregation, 20+ SPL detection rules, custom dashboards, alerting.
View Case Study →Production Wazuh deployment: agent management via GPO/Ansible, FIM, vulnerability detection (NVD), PCI-DSS/GDPR compliance monitoring, active response automation.
View Case Study →Elastic Fleet EDR deployment across 100+ cross-platform servers. Malware prevention, memory protection, LSASS guard, behavioral detection, EQL/KQL rules in Elastic SIEM.
View Case Study →Custom detection rules across Splunk SPL, Wazuh XML, Sigma, and Elastic EQL. Coverage: ransomware (T1486), lateral movement, persistence, privilege escalation.
View Project →End-to-end SOC automation: Wazuh webhook → IP/domain enrichment (VirusTotal + AbuseIPDB) → Telegram alert → JIRA ticket. MTTN <2 min.
View Project →Full Proxmox VE home lab: 8 VMs, 6-VLAN network segmentation, full security stack deployment, WireGuard VPN, IDS/IPS with Suricata, and attack simulation environment.
View Architecture →Network Security Monitoring with Suricata IDS, Zeek/Bro traffic analysis, JA3/JA3S TLS fingerprinting for encrypted C2 detection, full packet capture.
View Project →Methodology-driven web app security testing: OWASP Top 10 coverage, SQL injection, XSS, IDOR, authentication flaws, business logic vulnerabilities. Burp Suite Pro.
View Project →Automated bug bounty reconnaissance pipeline: subdomain enumeration, port scanning, tech fingerprinting, custom nuclei templates, vulnerability chaining methodology.
View Project →Custom detection content, threat hunting queries, and detection engineering outputs from production work.
T1110.001 — Detect 5+ failed logins from a single source within 2 minutes using Splunk stats command.
index=windows EventCode=4625
| stats count by src_ip, Account_Name
| where count >= 5
| eval severity="HIGH"
| table src_ip, Account_Name, count, severityT1059.001 — Detect encoded PowerShell execution and download cradles commonly used in malware delivery.
title: Suspicious PowerShell Execution
id: a4e4c5e1-b2f3-4d6a-8c9b
mitre: T1059.001
detection:
selection:
CommandLine|contains:
- 'encodedcommand'
- 'iex (new-object'
- 'downloadstring'
condition: selectionT1505.003 — FIM-based detection of PHP/ASP files dropped in web document roots.
<rule id="100003" level="15">
<if_sid>550,554</if_sid>
<field name="file">\.php$|\.aspx$</field>
<match>/var/www|inetpub</match>
<description>Web shell dropped [T1505.003]</description>
<mitre><id>T1505.003</id></mitre>
</rule>T1021 — Detect PsExec-style lateral movement using Elastic EQL sequence correlation.
sequence by host.name with maxspan=2m
[network where process.name == "services.exe"
and network.direction == "outgoing"]
[process where event.type == "start"
and process.parent.name == "services.exe"
and process.name != "svchost.exe"]Threat hunt query identifying LOLBins (certutil, mshta, wmic, regsvr32) used for malware download or code execution.
index=windows EventCode=4688
(Process_Name="certutil.exe" AND CommandLine="*-urlcache*")
OR (Process_Name="mshta.exe" AND CommandLine="*http*")
OR (Process_Name="wmic.exe" AND CommandLine="*process call create*")
| table _time, host, Process_Name, CommandLine, Account_NameT1486 — Detect mass file rename/modification indicative of ransomware encryption activity via FIM correlation.
<rule id="100010" level="14">
<if_sid>554</if_sid>
<same_source_ip/>
<occurrence>20</occurrence>
<timeframe>30</timeframe>
<description>Ransomware: mass FIM modification [T1486]</description>
<mitre><id>T1486</id></mitre>
</rule>Only verified certifications from completed courses and learning paths. No invented credentials.
Open to cybersecurity roles, SIEM/detection engineering contracts, VAPT projects, and bug bounty collaboration.