Yupeng Liu.
Explore my security world.

• Designed role-based access control (RBAC) to enforce least privilege across endpoints and data.
• Tested access controls with unauthorized requests and expired or tampered tokens, confirming the API rejected them with proper 401/403 responses.

• Performed static and dynamic analysis of malicious attachments using VirusTotal and sandbox environments to extract IOCs including hashes, domains, and IPs.
• Built Python scripts to automate phishing triage, reducing manual investigation time across repetitive analysis steps.

Microsoft Azure · Sentinel (SIEM) · KQL · Python

• Integrated Microsoft Sentinel for log collection and used KQL queries to analyze failed logins by IP and time.
• Added IP geolocation enrichment via Python scripts, detecting 500+ login attempts in 48 hours.

Wireshark · TCPDump · Ubuntu · Linux CLI

• Applied grep, cut, sort, and uniq to isolate repeated IPs, unusual ports, and anomalous packets.
• Identified intrusion indicators from packet headers, payload contents, and session flows across TCP and UDP.

Splunk · Sysmon · Windows Event Logs · MITRE ATT&CK

• Identified initial access vector, lateral movement, and persistence mechanisms mapped to MITRE ATT&CK techniques (T1059, T1547, T1003).
• Correlated process creation, network connection, and file modification events in Splunk to confirm scope of compromise.
• Produced a structured incident report with IOCs, affected assets, containment steps, and remediation recommendations.

Splunk · Sysmon · PowerShell Logs · Windows

• Progressively narrowed from broad data discovery to specific IOCs — uncovering payload download, persistence, and credential dumping.
• Identified attacker TTPs: encoded command execution (T1059.001), registry persistence (T1547.001), and LSASS access (T1003.001).
• Built and refined Splunk SPL queries to surface high-fidelity signals buried within high-noise PowerShell telemetry.

Splunk · Windows Security Logs · Event ID 4688

• Leveraged SubjectUserName, NewProcessName, and CommandLine fields to track full process lineage and confirm the attack chain.
• Correlated Security log artifacts with Sysmon data to cross-validate findings and eliminate false positives.
• Demonstrated how Security logs provide a complementary detection layer to Sysmon across the kill chain.