Full MITRE ATT&CK Coverage Map
Sanitized professional detection engineering project mapping attacker behavior to telemetry, detection logic, defensive coverage, and improvement opportunities.
View featured projectBlue Team · DFIR · Detection · AI Security
Dennis Kontic Cybersecurity Lab Portfolio
Welcome to my cybersecurity project portfolio. This site highlights hands on technical work across SOC analysis, digital forensics, incident response, malware analysis, detection engineering, vulnerability management, endpoint security, and AI security.
My goal is to show practical cybersecurity skills beyond certifications by documenting how I investigate alerts, reconstruct attacks, analyze evidence, map activity to MITRE ATT&CK, evaluate security controls, and communicate findings clearly.
Blue Team
SOC investigations, incident response, and threat hunting.
- SOC analysis
- Incident response
- Threat hunting
DFIR
Windows artifacts, memory analysis, network forensics, and malware triage.
- Digital forensics
- Memory analysis
- Malware analysis
Detection Engineering
MITRE mapping, alert logic, SIEM workflows, and defensive gap analysis.
- Detection logic
- SIEM investigation
- ATT&CK coverage
AI & Endpoint Security
AI application security concepts, EDR analysis, vulnerability management, and endpoint defense.
- AI security testing
- Endpoint investigation
- Vulnerability management
About This Portfolio
This portfolio is designed to give recruiters, hiring managers, and security professionals a clear view of my practical cybersecurity work. Each project focuses on how I approach evidence, analyze attacker behavior, document findings, and connect technical activity to defensive security outcomes.
The main purpose of this site is to show how I think as a security analyst. Instead of only listing certifications, this portfolio shows investigations, case notes, detection logic, forensic analysis, threat intelligence research, AI security study, and technical walkthroughs that demonstrate applied skill.
Featured Projects
These four projects best represent the depth of my defensive security work across detection engineering, incident response, SOC analysis, and malware investigation.
HTB CDSA Enterprise Intrusion Analysis
Seven day enterprise intrusion investigation focused on evidence correlation, attack reconstruction, incident response, and professional reporting.
View featured projectMicrosoft Sentinel Challenge Lab
SOC investigation using Microsoft Sentinel and Log Analytics for incident review, entity analysis, ownership, escalation, and case workflow.
View featured projectOski Stealc Malware Analysis
Sandbox and threat intelligence analysis of Stealc malware behavior, credential theft, configuration details, indicators, and MITRE ATT&CK mapping.
View featured projectProfessional Security Work — Sanitized Overview
Employer security work often depends on production logs, endpoint data, internal tooling, and sensitive user or business information. To protect that data, this section explains the security responsibilities and investigation concepts I work with without publishing raw employer artifacts.
CarShield — Security Responsibilities Within Level 1 IT Technician Role
My current responsibilities have expanded beyond traditional support into practical security operations.
- Vulnerability management: perform endpoint vulnerability scans across systems supporting three affiliated companies, document findings, and communicate remediation needs.
- EDR investigation: triage and investigate SentinelOne alerts involving malicious endpoint activity, phishing, and vulnerability related events, validate context, document findings, and escalate higher risk activity.
- Identity and privileged access: support user lifecycle administration, permissions, MFA, Microsoft Entra PIM, and least privilege access controls.
- Analyst thinking: evaluate process and command context, user activity, hashes, affected systems, and available endpoint evidence before determining whether activity requires escalation.
No production screenshots, endpoint names, IP addresses, internal detection logic, customer data, employee data, or raw CarShield logs are published here.
Ascend Learning — Security Operations & Detection Engineering
My Information Security internship provided hands on experience across SOC investigation, phishing analysis, alert tuning, and threat informed detection work.
- SIEM operations: triaged and investigated 10+ security alerts daily, classified events by severity, documented findings, and escalated verified high risk incidents.
- Phishing and malware analysis: investigated suspicious emails and malicious attachments using ANY.RUN and VirusTotal.
- Detection quality: identified false positive tuning opportunities to reduce alert fatigue and improve analyst efficiency.
- Detection engineering: mapped organizational telemetry to MITRE ATT&CK and developed detection logic across multiple security tools.
Only sanitized, non confidential details are included. Internal production data, proprietary detections, credentials, and sensitive organizational information are excluded.
All Technical Projects
These projects document hands on defensive security work across authorized lab environments, public training platforms, personal research, and sanitized professional experience.
HTB AI Security Lab Series
Public Academy study series covering prompt injection, AI data attacks, LLM output attacks, adversarial evasion, AI privacy, AI defense, and AI application security concepts.
View projectDeep Blue Investigation
Windows event log investigation involving suspicious process execution, Meterpreter style activity, service creation, and local account persistence.
View projectHTB CDSA Enterprise Intrusion Analysis
Hands on defensive security certification project focused on enterprise intrusion analysis, incident response, evidence correlation, and professional reporting.
View projectBlue Team Level 1 BTL1
Blue team certification lab covering phishing analysis, SIEM investigations, digital forensics, incident response, threat intelligence, and defensive reporting.
View projectCCDL1 SOC Analyst Certification
SOC analyst certification lab covering alert triage, cloud log review, AWS log analysis, threat detection, incident workflow, and investigation reporting.
View projectTryHackMe SAL1 Security Analyst
Security analyst certification project focused on SOC workflows, alert investigation, defensive operations, security tooling, and practical analyst decision making.
View projectCEHv13 Academia ELITE Labs
Hands on security lab bundle covering reconnaissance, enumeration, web application testing, cloud security, cryptography, malware concepts, and security tooling.
View projectBEC KY Investigation
Business Email Compromise investigation using Azure audit logs, email exports, suspicious inbox rules, and financial fraud indicators.
View projectOski Stealc Malware Analysis
Sandbox and threat intelligence analysis of Stealc malware behavior, credential theft, configuration details, and MITRE ATT&CK mapping.
View projectAPT34 OilRig Tabletop Exercise
Incident response simulation focused on unauthorized email access, lateral movement, containment, recovery, and response decision making.
View projectAPT29 Cozy Bear Tabletop Exercise
Incident response simulation involving unauthorized access, data exfiltration concerns, containment, escalation, and recovery planning.
View projectUNC3944 Scattered Spider Tabletop Exercise
Data theft tabletop exercise involving administrator misuse, cloud activity, Linux and Mac systems, containment, and team communication.
View projectTusk InfoStealer Threat Intelligence Lab
Threat intelligence investigation involving InfoStealer activity, malicious infrastructure, IOC extraction, and cryptocurrency wallet movement.
View projectAttacker Vs Six Defenders Tabletop Exercise
Defensive exercise design focused on attacker actions, defender counters, evidence sources, telemetry, and detection gap identification.
View projectFull MITRE ATT&CK Coverage Map
Sanitized detection engineering project mapping attacker behavior, telemetry, and detection logic across multiple security tools.
View projectMalicious ChatGPT Browser Extension Analysis
Malicious browser extension analysis covering obfuscation, credential theft, keylogging, cookie access, AES encryption, and exfiltration.
View projectVolatility Reveal Memory Analysis
Endpoint memory forensics focused on suspicious PowerShell activity, remote DLL execution, user context, and malware identification.
View projectOpenWire Wireshark Analysis
Packet capture investigation of Apache ActiveMQ exploitation, OpenWire traffic, malicious XML retrieval, and reverse shell payload delivery.
View projectMicrosoft Sentinel Challenge Lab
SOC investigation lab focused on Microsoft Sentinel incidents, Log Analytics, entity review, incident ownership, and escalation workflow.
View projectOSINT and Digital Forensics Cerulean Lab
Forensic investigation involving suspicious RDP activity, browser history, Slack usage, Google Drive activity, and Windows Defender logs.
View projectReverse Malware Engineering BlackEnergy 2 Lab
Memory based malware investigation using Volatility 2, malfind, SSDT hooks, driver dumping, and SHA256 enrichment.
View projectCountdown Digital Forensics Lab
Forensic disk image investigation involving Autopsy, Windows artifacts, messaging data, browser history, thumbnail cache, and SQLite review.
View projectHaunted Company Threat Intelligence Lab
Threat intelligence investigation involving Base64 decoding, ExifTool metadata, IOC extraction, adversary analysis, and web shell attribution.
View projectIntroduction to Phishing SOC Simulator
Splunk based SOC simulator lab focused on phishing alerts, suspicious emails, attachment evidence, case reports, and True Positive closure.
View projectPhishing Unfolding SOC Simulator
Live phishing attack simulation involving PowerShell execution, reverse shell behavior, suspicious DNS requests, and case reporting.
View projectReal Life Phishing Message Analysis Using ANY.RUN
Safe analysis of real phishing messages using ANY.RUN to inspect suspicious links, redirect behavior, attacker intent, and indicators.
View projectCurrent Direction
This portfolio is being expanded around the work I am doing and studying now: security operations, endpoint investigation, vulnerability management, identity and privileged access, incident response, detection engineering, and AI security. Employer material will remain sanitized and theory focused whenever production evidence cannot be shared safely.