Cyberster Internship Labs
A comprehensive journey through Security Operations Center (SOC) training, digital forensics, and incident response.
SOC Foundations & Threat Detection
Weeks 1-4
SIEM, IDS, Network Security Monitoring
Deployed and configured a complete Security Operations Center (SOC) from the ground up. Built a layered monitoring architecture using Wazuh SIEM, Suricata IDS, and pfSense firewall.
Show Details & Artifacts
▸ Key Tasks
- Deployed Wazuh Manager and Agents on Ubuntu/Kali/Windows for host-based intrusion detection
- Configured File Integrity Monitoring (FIM) on critical directories (/etc, C:\Windows)
- Installed and configured Suricata IDS with custom rules for Nmap scans, HTTP attacks, and ICMP floods
- Integrated Suricata alerts into Wazuh for unified dashboard visibility
- Deployed pfSense firewall as network perimeter with syslog forwarding to Wazuh
- Wrote custom Wazuh rules for SSH brute force, USB insertion, and user account creation
- Implemented GeoIP blocking using ipset and iptables for China, Russia, and North Korea
▸ Tools Used
✓ Key Findings
- Successfully correlated network (Suricata) and host-based (Wazuh) alerts for 360-degree visibility
- Custom SSH brute-force rule (100200) triggered automatic IP blocking via active response
- Created 3 custom Suricata rules validated against live PCAP traffic
Malware Analysis & Incident Response
Week 5
Static & Dynamic Analysis, Detection Engineering
Conducted a comprehensive investigation of two malware families (Zeus Banking Trojan & njRAT). Performed safe, air-gapped analysis and developed production-ready detection rules.
Show Details & Artifacts
▸ Key Tasks
- Established a secure, air-gapped analysis environment using pfSense WAN isolation
- Performed static analysis (file identification, strings, binwalk, exiftool) to extract IOCs
- Computed cryptographic hashes (MD5, SHA-256) for malware identification
- Executed dynamic analysis in ANY.RUN sandbox to observe real-time behavior
- Mapped malware behaviors to MITRE ATT&CK framework
- Developed 5 custom Suricata rules for Zeus C2 and payload detection
- Authored a NIST SP 800-61 compliant Incident Response Plan
▸ Tools Used
✓ Key Findings
- Zeus (ZAccess) identified as banking trojan with 64/72 antivirus detections
- njRAT confirmed as Remote Access Trojan using persistence and firewall evasion
- Created 5 Suricata rules that successfully detected Zeus C2 traffic
Insider Threat Simulation
Week 6
Attack and Defend with Living-off-the-Land (LOLBins)
Executed a complete insider threat attack chain from both Red and Blue Team perspectives. Used legitimate Windows tools (LOLBins) for data exfiltration and built custom detection rules.
Show Details & Artifacts
▸ Key Tasks
- Acted as Red Team insider using PowerShell and certutil.exe to stage and encode data
- Exfiltrated Base64-encoded data via HTTP POST to a netcat listener
- Performed anti-forensics by deleting all evidence (files and registry keys)
- Switched to Blue Team to hunt for FIM alerts in Wazuh dashboard
- Decoded exfiltrated data using CyberChef to recover stolen credentials
- Engineered custom Wazuh rule (ID 100500) to detect Base64 file creation
▸ Tools Used
✓ Key Findings
- Wazuh FIM captured all file creation, modification, and deletion events in real-time
- Custom rule 100500 deployed to detect encoded staging files (MITRE T1027)
- Recovered stolen credentials: CLIENT: Cyberster | ACCT: 4459 | PW: AdminPassword2026!
Digital Forensics (DFIR) - Disk & Memory Analysis
Weeks 7-10
Autopsy, FTK Imager, Registry & Volatility
Dove deep into Windows digital forensics. Acquired disk images, analyzed NTFS file systems, parsed Windows registry, and performed volatile memory analysis on suspect workstations.
Show Details & Artifacts
▸ Key Tasks
- Performed forensically sound disk acquisition using FTK Imager (E01 format)
- Verified image integrity with MD5/SHA-1 hashing and chain-of-custody documentation
- Analyzed NTFS file systems: MFT, Alternate Data Streams (ADS), and MACB timestamps
- Used Autopsy to build cases, recover deleted files, and generate forensic reports
- Extracted and parsed Windows Security Event Logs with EvtxECmd
- Analyzed Prefetch files with PECmd and LNK files with LECmd
- Performed memory forensics using Volatility 3 on raw RAM dumps
▸ Tools Used
✓ Key Findings
- Recovered deleted files from NTFS image including .docx and .xlsx files
- Found Alternate Data Stream (ADS) containing malicious JPEG (HARDCORE.jpg)
- Identified TrueCrypt service set to Start=System (automatic full-disk encryption)
Corporate Espionage Investigation (Capstone)
Weeks 11-12
M57.biz Incident: 3-Source Correlation
My Phase Two capstone investigation of a real corporate espionage case. Correlated evidence from disk images, RAM dumps, and USB drives to prove insider threat activity.
Show Details & Artifacts
▸ Key Tasks
- Analyzed PST email archives to uncover Business Email Compromise (BEC) attack
- Correlated LNK, Prefetch, and Registry artifacts to prove file access and exfiltration
- Identified impersonation attack using display name spoofing with different mailto address
- Identified culprit's USB device containing stolen patent data
- Used Volatility memory analysis to prove user-initiated memory acquisition
- Built super-timeline in Autopsy filtering 1M+ events to 8 decisive ones
▸ Tools Used
✓ Key Findings
- Using super-timeline filtered 1M+ events down to 8 decisive ones proving 4-stage action sequence
- Identified two-channel exfiltration: USB drive AND SMB network share (192.168.1.104:139)
- Identified underlying mailto address (tuckgorge@gmail.com) different from display (alison@m57.biz)
Ready to See More?
Download the artifacts above to see the full reports, rules, and analysis from my internship.