Abdul Majid Khan

Security+ certified cybersecurity professional with hands-on experience in SOC operations, SIEM (Splunk, Wazuh), and network traffic analysis using Wireshark. Proficient in Linux and Windows log analysis, incident response, and threat detection. Skilled in identifying and mitigating security incidents across network and endpoint systems.

1.Splunk Project — Suspicious Login Dashboard

• Built custom detection dashboard correlating Windows event logs for failed logins, geolocation anomalies, and brute-force attempts.
• Tuned false positives and implemented alert actions for SOC analysts.

Tools: Splunk Enterprise, Sysmon, Windows Event Logs

Outcome: Improved detection coverage for brute-force and credential-stuffing attacks.

2.Phishing Email Analysis Lab (Linux + PowerShell)

• Analyzed phishing .eml files—extracted headers, URLs, and attachments.
• Performed static malware inspection with olevba and pdf-parser and enriched hashes.
• Documented IOCs and authored a SOC triage response playbook.

Tools: Linux CLI, PowerShell, VirusTotal, Cuckoo Sandbox

Outcome: Developed reusable phishing analysis workflow for L1 analysts.