Investigative DFIR Specialist focused on host and network artifact triage across complex intrusion killchains. Experienced in extracting hidden payloads from volatile RAM, detecting sub-millisecond timestomping across NTFS records, and auditing Sysmon telemetry for covert persistence. Combines hands-on reverse engineering in Ghidra with automated forensic scripting to accelerate enterprise incident containment.

Enterprise Incident Response Capstone

• Reconstructed a complete APT killchain across Network, RAM, Disk, and Event Logs.

• Proved in-memory credential theft (LSASS dumping) by tracking Sysmon Event ID 10.

• Detected rootkit persistence by parsing offline SYSTEM registry hives for malicious boot-start drivers

Endpoint Forensics & Threat Hunting Scenarios

• Tracked attacker lateral movement and data exfiltration using Prefetch, Shellbags, and LNK analysis.

• Mathematically proved deliberate timestomping by correlating NTFS $MFT timestamp discrepancies.

• Hunted advanced fileless malware by dissecting Sysmon IDs 19-21 to uncover encoded PowerShell payloads hiding in WMI.

Memory & Network Forensics

• Utilized Volatility to extract injected code, VAD hooks, and hidden DLLs from raw memory dumps (e.g., Stuxnet triage).

• Conducted PCAP analysis using Wireshark to isolate malware beacons and extract malicious payloads from HTTP streams

Biometric Employee Access Scanner

Developed a biometric attendance/access prototype connecting hardware flow with software tracking.

Higher Technological Institute (HTI) | Computer Science - In Progress