THE ANALYST CASEBOOK VOL. 01 / 2026
I’m Shahzeb, a cybersecurity practitioner focused on SOC operations. I turn suspicious activity into clear findings through investigation, analysis, and a healthy dose of curiosity.
Abu Dhabi, UAE Open to junior SOC opportunities
01 / SELECTED WORK
A look at how I investigate,
connect evidence, and document findings.
Investigating a simulated compromise: suspicious PowerShell, encoded content, and DNS-tunnelling indicators. Following the evidence to reconstruct attacker activity.
Read investigation summaryTryHackMe Simulated enterprise environment
Reviewed Sysmon and endpoint-related evidence in a simulated enterprise compromise. Decoded Base64 content and reconstructed activity using the Cyber Kill Chain, connecting phishing activity with suspicious PowerShell execution and DNS-tunnelling indicators.
Mapped observed behavior to MITRE ATT&CK, documented detection gaps, and developed practical rule recommendations. The focus was explaining the evidence, not simply listing indicators.
This is a resume-backed project summary, not a full forensic report. Raw logs, exact queries, and detailed technique mappings are not published here. DNS indicators alone do not establish confirmed exfiltration.
Identified and responsibly reported an IDOR / Broken Access Control issue affecting a production API. Prepared a proof of concept and documented the issue against OWASP Top 10 A01: Broken Access Control. The report contributed to a production fix.
Only a high-level summary is public. No private report, vulnerable endpoint, exploit instructions, or user data is published.
Investigation-oriented challenges on Blue Team Labs Online and TryHackMe, applying networking and Linux fundamentals to suspicious activity. Practice centers on reviewing logs, evaluating alerts, and documenting the reasoning behind conclusions.
Training environments, not production SOC experience. No platform rank, challenge count, or performance metric is claimed.
Completed the Mastercard Cybersecurity Virtual Experience on Forage. Reviewed simulated phishing campaigns and departmental risk exposure, then developed targeted security-awareness recommendations.
A virtual experience program, not employment or an internship at Mastercard.
02 / THE PERSON BEHIND THE PROCESS
I’m a Computer Science graduate based in Abu Dhabi, building my path into security operations through hands-on investigations, blue-team labs, and continuous learning.
I’m drawn to the work between an alert and an answer: understanding what happened, checking the evidence, and writing it down so someone else can act on it.
03 / WORKING TOOLKIT
Hands-on practice and foundational knowledge.
No percentage bars. No inflated claims.
Splunk · Microsoft Sentinel · ELK Stack · Sysmon · Windows Event Logs · Linux syslog · Wireshark
MITRE ATT&CK · Cyber Kill Chain · Phishing analysis · IOC enrichment · Threat hunting fundamentals · OWASP Top 10
Python · Bash · PowerShell · Linux CLI · Active Directory fundamentals
04 / EXPERIENCE & FOUNDATIONS
Networkwalks
Selected for a cybersecurity internship with planned exposure to security operations, incident response, digital forensics, and network security.
Scheduled program. Responsibilities and outcomes will be updated as work is completed.
Lahore Garrison University
Lahore, Pakistan
Credentials as listed on my resume. Verification links available on request.
NEXT / A CONVERSATION
ABU DHABI, UAELooking for a curious, evidence-led addition to your SOC team?
I’d love to hear from you.