AshtonAng
Work

Things I've built

A working list. Each one taught me something specific, and the notes under every project say what.

Showing 7 of 7

Detection & response

SOC Homelab

A rebuilt two-layer SOC lab, Wazuh watching the host and Suricata watching the wire, built around one question: what does network monitoring catch that host monitoring doesn't.

I kept Wazuh, the host-layer SIEM from the original lab, and added Suricata as a second, network-layer sensor, then ran the same three attacks at both and compared what each one actually saw. An nmap scan turned out structurally invisible to the host, since a SYN scan never completes a connection. A rebuilt 2017 Samba exploit landed root that only the network layer could prove, straight off the wire, because nothing on the host was pointed at the right signals. A cron-based fake beacon got logged by the host in full and never once turned into an alert. Closing part of that last gap meant writing my own Suricata rule and chasing a false lead through a real pre-existing decoder bug before finding the actual problem.

  • Wazuh
  • Suricata
  • Docker
  • IDS/IPS
  • Detection engineering
  • MITRE ATT&CK
Read the summaryAttack: nmap scanAttack: Samba CVEAttack: C2 beaconHost-layer limits (DVWA)
Detection & response

Splunk BOTSv1

Two write-ups working through Splunk's own 33-million-event BOTSv1 training dataset as the defender, a website defacement and a ransomware outbreak on the same simulated network.

I loaded Splunk's pre-indexed BOTSv1 dataset, 33,413,777 events of Windows, Sysmon, firewall, and web traffic, and worked through both of its scenarios question by question instead of skimming to the answer key. Scenario 1 chases the Po1s0n1vy group through Joomla logs to a stolen admin login hiding in a session cookie. Scenario 2 traces a Cerber ransomware outbreak from a parking-lot USB drive through a steganographic payload hidden inside a jpeg. 29 questions total, and enough wrong turns across both, misread fields, a table command that silently dropped results, a file count contaminated by the wrong multivalue field, to make the right answers actually mean something.

  • Splunk
  • SIEM
  • Log analysis
  • Incident investigation
  • Ransomware
Scenario 1 — Batman?!Scenario 2 — Cerbus
Tooling & automation

Mini SIEM

A Python tool that parses a Linux auth log once and runs four detection rules over it, then prints a ranked alert report.

It reads an auth.log, turns every SSH login line into a structured event with the status, user, IP and timestamp, then runs four rules over those events: a keyword match on the raw lines, a suspicious-IP watchlist, an off-hours check for logins between midnight and 6am, and a brute-force rule that fires when one IP racks up five or more failures inside a short window. The report counts alerts per rule so the loudest thing sits at the top. Standard library only. I built it as the next step up from my failed-login counter, because parsing once and detecting many times is the shape of the SOC work I want to do.

  • Python
  • Detection rules
  • Log parsing
  • Regex
  • SOC
Read the write-upSource
Offensive security

Hack The Box: Oopsie

My first full Hack The Box machine, taken from a guest cookie to a shell on the box.

I chained four simple web vulnerabilities together to gain access into a system. An IDOR flaw that got me the administrator's account ID, editing browser cookies to trick the site, uploading and executing a reverse shell PHP script, and found a reused database password.

  • Hack The Box
  • Web exploitation
  • Burp Suite
  • Reverse shell
  • Linux
Read the write-up
Tooling & automation

SSH Failed Login Analyzer

A Python tool that reads a Linux auth log and reports which IP addresses keep failing to log in over SSH.

It scans auth.log for "Failed password" lines, pulls the IPv4 address out of each one with a regex, and counts attempts per address so the noisiest sources sit at the top. Standard library only, split into small read, count, and report functions with clear handling for a missing or unreadable file. I built it because triaging auth logs is the kind of work a junior analyst actually does, and I wanted to do it by hand before reaching for a bigger tool.

  • Python
  • Log parsing
  • Regex
  • SSH
Read the write-upSource
Networking

Subnet Scanner

A command line tool that finds live hosts on a network and checks which common ports they have open.

You give it a subnet in CIDR notation. It pings every address to find live hosts, then opens short lived TCP connections to common ports like SSH, HTTP, HTTPS, SMB, and RDP on each host that answered, and prints a table of hosts and their open ports. It runs on a thread pool, so a full subnet finishes in seconds instead of minutes, and it stays on the Python standard library. Building it made me separate the two questions a scan really asks: is this host alive, and is something listening behind that port.

  • Python
  • Networking
  • Port scanning
  • Threading
Read the write-upSource
Sockets

LAN Chat Room

A console chat app in Python that runs a server and connects multiple clients over a local network.

One machine runs the server, others join as clients by pointing at its local IP, and messages pass between them in real time. It was my first proper look at sockets and the client to server model, including the small frustrations of getting two machines to talk on the same network.

  • Python
  • Sockets
  • Networking
Read the write-upSource