Investigations & projects
Detection playbooks and case studies showing how I investigate: the queries, filters and commands I run, what I look for, and how it maps to MITRE ATT&CK.
Featured investigations
SIEM · Threat detection playbook
Hunting malicious PowerShell with Splunk and Sysmon
How I detect, triage and scope suspicious PowerShell activity in Splunk, from an encoded command line to persistence and outbound connections, with the SPL I use at each step and the ATT&CK techniques it maps to.
- T1566.001
- T1059.001
- T1027
- T1547.001
Network · Traffic analysis playbook
Investigating a suspicious PCAP in Wireshark
A repeatable workflow for working through a packet capture, from protocol overview to C2 beaconing, DNS abuse and file downloads, with the exact Wireshark filters and how each finding becomes an IOC.
- T1046
- T1071.001
- T1071.004
- T1105
DFIR · Digital forensics playbook
Triage of a compromised Windows host, from memory to timeline
How I acquire and analyse memory and disk evidence from a suspected compromised Windows machine with FTK Imager, KAPE, Volatility 3 and DeepBlueCLI, and turn scattered artefacts into one incident timeline.
- T1078
- T1021.001
- T1055
- T1543.003
More work
Email · Threat analysis playbook
Phishing email analysis playbook
The checklist I follow for a reported email, covering headers, authentication results, links and attachments, to reach a clear benign, suspicious or malicious verdict with IOCs ready to block.
- CyberChef
- VirusTotal
- WHOIS
- MXToolbox
AppSec · MSc dissertation
LLM triage for static-analysis findings
A Python pipeline that uses a large language model to evaluate Semgrep and Bandit findings, triage likely false positives and generate remediation guidance.
- Python
- LLM
- Semgrep
- Bandit
Web · Side project
saljookhaider.com, a portfolio built like a security project
This site. Static Astro build on Cloudflare Workers with a strict Content-Security-Policy, HSTS and no third-party scripts, plus a working terminal, a blog and RSS.
- Astro
- TypeScript
- Cloudflare Workers
- CSP