Security Portfolio Overview on Lorenzo Swany — Website Portfolio

Case A – Authentication Abuse & Brute Force Detection

Mon, 01 Jan 0001 00:00:00 +0000

Case A – Authentication Abuse & Brute Force Detection#

MITRE ATT&CK#

Tactic: Initial Access
Technique: T1110.003 – Brute Force: Password Spraying

This project demonstrates detection and investigation of repeated failed network authentication attempts using Windows Security logs and Splunk.

Scenario#

A Windows host begins receiving multiple failed remote logon attempts from a single source IP within a short period of time. The objective is to determine whether the activity represents brute-force behavior, password spraying, or benign misconfiguration.

Profile

Mon, 01 Jan 0001 00:00:00 +0000

Profile#

I’m an IT professional with experience in network & systems support and a strong interest in Cybersecurity. I currently support two major sites within a large school district environment.

Through self-study, I’m building experience in SOC investigation, identity-driven risk, and cloud security fundamentals. The projects on this site are intended to document hands-on scenarios where I’ve designed detections, simulated investigations, and documented findings in a SOC-style workflow. My work emphasizes attack progressions from initial access through execution and persistence. The goal is to create replicatable end-to-end scenarios: collecting relevant telemetry, analyzing anomalies, and communicating results & findings clearly.

Case B - Suspicious PowerShell Execution

Mon, 01 Jan 0001 00:00:00 +0000

Case B – Suspicious PowerShell Execution#

MITRE ATT&CK#

Tactic: Execution
Technique: T1059.001 – Command and Scripting Interpreter: PowerShell

This project demonstrates detection and investigation of suspicious PowerShell activity using Windows Security process creation logs and Splunk.

Scenario#

PowerShell execution was observed on a Windows endpoint from a standard user account. Because PowerShell is frequently abused by attackers for script execution, payload retrieval, and system reconnaissance, the activity was reviewed to determine whether the behavior represented legitimate administrative use or potentially malicious script execution.

Home Lab Overview - SOC Triage & Decision-Making Lab

Mon, 01 Jan 0001 00:00:00 +0000

SOC Triage & Decision-Making Home Lab#

Purpose#

This home lab exists to support the security projects documented on this site. It is intentionally scoped to generate realistic telemetry and enable repeatable investigation workflows.

The goal is to demonstrate how I:

design a small environment that produces useful logs,
build detections and triage logic in a SIEM,
investigate alerts end-to-end,
document findings and recommendations in a SOC-style format.

Architecture#

The lab produces endpoint + network events and forwards them to a centralized SIEM where detections, triage, and investigation take place.

Case C – Unexpected Scheduled Task Creation

Mon, 01 Jan 0001 00:00:00 +0000

Case C – Unexpected Scheduled Task Creation#

MITRE ATT&CK#

Tactic: Persistence
Technique: T1053.005 – Scheduled Task/Job: Scheduled Task

This project demonstrates detection and investigation of a suspicious scheduled task created on a Windows endpoint, using Windows Security logs and Splunk.

Scenario#

A scheduled task was created on a Windows endpoint outside of expected administrative activity. Because scheduled tasks are frequently used by attackers to maintain persistent access across reboots, the activity was reviewed to determine whether the task was legitimate or a potential persistence mechanism.