/ Work

Things I've built.

01

STAS — Security Timeline Analysis Suite

2025
  • C++17
  • Python
  • PyQt6
  • YARA
  • Sigma
  • Enterprise malware analysis platform combining a high-performance C++ static analysis engine with AI-powered behavioral intelligence and threat correlation.
  • Static and dynamic analysis: PE parsing, per-section entropy analysis, packer detection, YARA scanning, and simulated process/file/registry/network timelines stored in SQLite for forensic reconstruction.
  • IOC extraction engine with confidence scoring and async enrichment via VirusTotal, MalwareBazaar, URLhaus, AbuseIPDB, and ThreatFox.
  • Auto-generates YARA and Sysmon-compatible Sigma detection rules from analysis results; automatic MITRE ATT&CK technique inference.
  • NetworkX-based campaign correlation across shared C2, mutexes, and imports, exporting to STIX 2.1 and MISP; PyQt6 dashboard handling 10k+ events.
02

ShadowForge Red Team Simulation Framework

2026
  • C#14
  • .NET 10
  • Blazor
  • Seven-project red team simulation framework aligned to MITRE ATT&CK and NIST CSF 2.0, purpose-built to generate realistic Windows and Linux telemetry for detection validation.
  • Simulates credential attacks, persistence mechanisms, privilege escalation, lateral movement (SMB, WMI), and network reconnaissance mapped to specific ATT&CK technique IDs.
  • Generates Windows Event Log artifacts, Sysmon events, and process/network telemetry detectable by Wazuh and Microsoft Sentinel.
  • Used to validate detection rules — confirming true positives, tuning false positives, and verifying Sigma rule coverage against each simulated technique.
03

AegisCore — AI-Native University ERP Platform

2025 – 2026
  • Next.js
  • Node.js
  • PostgreSQL
  • Docker
Built under Nocturne Systems
  • Founder-built enterprise ERP platform targeting Pakistan's higher education sector; architected for full HEC and NBEAC compliance across admissions, academics, finance, HR, and accreditation workflows.
  • Role-based access control for multi-tenant university environments, with separate privilege tiers for students, faculty, department heads, registrar, and finance offices.
  • AI-driven academic analytics module: enrollment forecasting, student performance risk scoring, and accreditation audit trail generation for HEC reporting.
  • Containerized full-stack deployment (Docker + nginx + PostgreSQL) with end-to-end TLS; in enterprise pilot evaluation with IoBM (Institute of Business Management, Karachi).
  • IPO Form-II copyright registered under Nocturne Systems; corporate structure spans Pakistan, Singapore (IP holdco), and UAE entities.
04

Advanced SOC & Malware Detection Homelab

2025 – 2026
  • Wazuh
  • Microsoft Sentinel
  • Splunk
  • Sysmon
  • Multi-node homelab SOC built on DigitalOcean and local VMs: a dedicated Wazuh manager node, Wazuh agent endpoints (Windows + Linux), an isolated malware analysis sandbox, and a SIEM aggregation node.
  • Forwarded Wazuh/Sysmon events to a Microsoft Sentinel workspace and wrote KQL analytics rules for process anomaly detection, network beacon detection, and privilege escalation patterns; wrote SPL queries and threat hunting dashboards in Splunk.
  • Full malware triage workflow: controlled detonation on isolated test nodes, alert investigation through true/false positive determination, IOC extraction, process tree analysis, and filesystem change analysis.
  • Threat hunting with Wireshark PCAP analysis, reconstructing lateral-movement timelines and following attack chains from initial execution through privilege escalation.