jaalso@kali:~$ ls -la projects/
Projects & Tools — standing capabilities I built
not one-off exercises — tools and systems I built and use, with defined purpose and real output
Two standing capabilities: an automated Windows triage tool that codifies a manual IR process into one script, and a structured 7-layer CTI intelligence system. Each has produced a real result, not just a demo.
PS
Automated Windows Triage Tool — Invoke-CompromiseCheck.ps1 ⭐
Codified ~20 manual PowerShell IR commands into one portable script — 20 forensic sections in 13 seconds, colour-coded severity, timestamped report. During development it surfaced a real Defender false-positive that Microsoft later acknowledged worldwide.
▸ expand for 30-sec pitch + details
▶
30-second interview pitch
"After manually running about 20 PowerShell commands every time I had a compromise concern on a Windows host, I codified the whole methodology into one portable script. Run it as Administrator and it checks 20 forensic sections in 13 seconds — RDP logon detection, failed-logon analysis with audit-policy verification, Defender signature freshness and threat history, suspicious PowerShell patterns like EncodedCommand and IEX, hosts-file tampering, remote-access-software inventory — with tiered severity output and a timestamped report. There's a quick mode too: 8 highest-signal checks in under 60 seconds."
🔦 The killer finding — lead with this
During development, the tool's threat-history section surfaced a real Defender false-positive that Microsoft publicly acknowledged and fixed: the worldwide incident where a signature update flagged two legitimate DigiCert root CAs as Trojan:Win32/Cerdigent.A!dha and quarantined them, corrected in signature 1.449.430. Raw Get-MpThreatDetection output buries this — Section 15 made it immediately legible. A real false-positive, surfaced by my own tooling.
Key checks (20 sections)
RDP-specific logon detection (LogonType 10, active + historical) · failed-logon analysis with audit-policy verification (catches "empty result = audit disabled") · Defender signature freshness + full-scan age + threat history · suspicious PowerShell patterns (-EncodedCommand, IEX, Net.WebClient) · hosts-file tampering + DNS cache · remote-access-software inventory (TeamViewer, AnyDesk, VNC, RustDesk, ScreenConnect)
Tools / Platform
PowerShell 5.1+ & 7+ · CIM/WMI
Windows Event Log · MpComputerStatus
net localgroup · auditpol
Win 10/11 · Server 2016+
Windows Event Log · MpComputerStatus
net localgroup · auditpol
Win 10/11 · Server 2016+
Why it matters
Turns a 20-command manual process into a 13-second script — the automation instinct JDs mean by "reduce manual work" — and the audit-policy check ("empty result = not logging, not 'nothing happened'") shows real detection-engineering depth.
CTI
CTI Dashboard — 7-Layer Threat Intelligence System
A working 7-layer CTI dashboard in Inoreader (63 feeds) covering professional intelligence (L1–6) plus daily-life breach awareness (L7), with a DACH regional layer. The standing system behind the Storm-1865 triage — read daily.
▸ expand for 30-sec pitch + details
▶
30-second interview pitch
"I built a seven-layer CTI dashboard in Inoreader — 63 feeds organized by purpose, not just a pile of RSS. Each layer answers a specific question at a specific cadence: news daily, IOCs and CVEs daily, hunt queries weekly, actor context weekly, reference on-demand, community weekly, and a daily-life breach-awareness layer, plus a DACH regional layer for Swiss and German coverage. It's not a one-off — I read it every day, and it's the system I used to triage the Storm-1865 phishing campaign."
The 7 layers — each answers a question at a cadence
L1 News (what's happening — daily) · L2 IOCs/CVEs (what to detect — daily) · L3 Hunt Queries (how to hunt — weekly) · L4 Actor Context (who/why — weekly) · L5 Reference (bookmarks — on-demand) · L6 Community (learning — weekly) · L7 Daily-life / Breach Awareness (is this scam real? — daily) · + DACH region (Swiss/German — daily)
Tools
Inoreader (63 feeds, OPML-managed)
AlienVault OTX API · abuse.ch
MITRE ATT&CK
AlienVault OTX API · abuse.ch
MITRE ATT&CK
Proof it works
This is the answer to "how do you stay current on threats?" — a structured system with defined cadences, not "I read the news." It produced a real result: the Storm-1865 triage → NCSC acknowledgment.