JAWAD AHMADI

Windows Event Log Collection
Security events collected from endpoint JAWAD.CYBERJAWAD.LOCAL and analyzed in Splunk. Demonstrates SIEM log ingestion, Windows event monitoring and security visibility.

Computer Name: JAWAD.CYBERJAWAD.LOCAL
Host: JAWAD
User: CYBERJAWAD\jahmadi
Events: EventCode 158, EventCode 8224

Authentication & Privileged Access Monitoring
Monitoring successful logons and privileged account activity through Windows Security events. This demonstrates detection of authentication behavior and privilege usage.

Computer Name: JAWAD.CYBERJAWAD.LOCAL
Host: JAWAD
User: CYBERJAWAD\jahmadi
Events: EventCode 4624, EventCode 4672

User Account Creation Detection
Detecting and investigating new user account creation activity through Windows Security logs. Demonstrates monitoring of Active Directory changes and account management events.

Computer Name: DC01.CYBERJAWAD.LOCAL
Host: DC01
Role: Domain Controller
Activity: User Account Creation Detection

PowerShell Execution Monitoring
Monitoring PowerShell activity to identify script execution, administrative actions, and potentially suspicious behavior.

Computer Name: JAWAD.CYBERJAWAD.LOCAL
Host: JAWAD
User: CYBERJAWAD\jahmadi
Skills: PowerShell logging, script analysis, threat detection

Active Directory Domain Overview
CYBERJAWAD.LOCAL Active Directory environment showing the domain structure and centralized Windows identity management.

Domain Controller Configuration
Windows Server 2022 configured as the primary Domain Controller for the CYBERJAWAD.LOCAL environment.

User Account Management
Managing domain user identities through Active Directory Users and Computers including employee account administration.

Default Domain Policy Management
Configured centralized security policies through Group Policy to enforce domain-wide security settings.

Password Policy Configuration
Implemented password security controls including complexity, password history and password expiration requirements.

Account Lockout Policy
Configured account lockout protections to reduce brute-force authentication attacks and unauthorized access attempts.

Domain Authentication Login
Windows 11 workstation authenticating through the CYBERJAWAD.LOCAL Active Directory domain.

SIEM Data Collection Pipeline
Configured Splunk Universal Forwarder on Windows endpoints to securely collect security telemetry and forward logs to Splunk SIEM. This provides centralized visibility for security monitoring and investigation.

Component: Splunk Universal Forwarder
Endpoint: JAWAD.CYBERJAWAD.LOCAL
SIEM: Splunk Enterprise
Purpose: Endpoint telemetry ingestion

Endpoint Telemetry Monitoring
Collected Windows security events from domain-connected endpoints to establish visibility into authentication activity, user behavior and system changes.

Data Source: Windows Event Logs
Host: JAWAD
Platform: Windows 11 Endpoint
Analysis: Security Event Investigation

Failed Authentication Detection
Investigated Windows Security Event ID 4625 to identify failed login attempts. The investigation analyzed account names, source addresses and failure reasons to identify suspicious authentication activity.

Event ID: 4625 Failed Logon
Source: Windows Security Logs
Detection Type: Authentication Monitoring
SIEM: Splunk

PowerShell Activity Investigation
Analyzed PowerShell execution activity using Windows PowerShell Operational logs. Script Block Logging provided visibility into executed commands and administrative actions.

Event ID: 4104 Script Block Logging
Source: PowerShell Operational Logs
Detection: Command Execution Monitoring
Platform: Windows Endpoint

User Account Creation Detection
Monitored Active Directory security events to identify new account creation activity. Account creation events can indicate legitimate administration or potential persistence techniques.

Event ID: 4720 User Account Created
Source: Windows Security Logs
System: DC01 Domain Controller
Detection: Identity Monitoring

Threat Hunting Summary
Performed security investigations using Splunk SIEM and Windows telemetry. Analyzed authentication failures, PowerShell activity and Active Directory changes to identify suspicious behavior and improve endpoint visibility.

Vulnerability Assessment Environment
Configured a controlled lab environment and performed an automated security scan using Tenable Nessus to identify potential weaknesses.

Security Findings Analysis
Reviewed vulnerability results, severity ratings and affected services to evaluate security impact and prioritize risks.

SMB Vulnerability Assessment & Remediation
Analyzed SMB-related security findings and reviewed recommended remediation steps to improve system security posture.

Assessment Summary
The vulnerability assessment identified security findings affecting the target system. Findings were reviewed based on severity, affected services and potential impact to determine appropriate remediation steps.

Remediation Recommendations
Recommended actions included applying security updates, reviewing exposed services, strengthening system configurations and following vendor-provided mitigation guidance to reduce security risk.

Assessment Scope
Target: Metasploitable 2 Linux Virtual Machine
Target IP: 192.168.56.106
Attacker Machine: Kali Linux
Tools Used: Nmap, Netcat
Testing Type: Authorized Penetration Testing Lab
Objective: Identify security weaknesses exploit vulnerable services and document security impact.

Target Environment Overview
Configured the Metasploitable 2 vulnerable Linux machine as the target system within an isolated penetration testing lab environment.

Network Reconnaissance
Performed Nmap service version detection to identify open ports running services and potential attack surfaces on the target system.

Service Enumeration
Analyzed discovered services and configurations to identify vulnerable applications and possible exploitation opportunities.

Vulnerability Identification
Identified an exposed bind shell service running on port 1524 that allowed unauthorized command execution on the vulnerable system.

Exploitation Success
Connected to the vulnerable service using Netcat and obtained root-level access within the authorized penetration testing environment.

Assessment Summary
The penetration testing assessment identified vulnerable services within the Metasploitable 2 environment. Through reconnaissance, service enumeration and exploitation testing unauthorized root-level access was successfully demonstrated in the controlled lab environment.

Security Recommendations
Recommended actions include disabling unnecessary services, applying security patches, removing insecure configurations, restricting exposed ports and implementing proper access controls to reduce attack surface.