Kazim Ali

Technical Arsenal

Skills & Tools

Network Security

Reconnaissance, scanning & traffic analysis

Nmap Wireshark Zeek RITA tcpdump Network Flow

Intrusion Detection

Rule engineering & log analysis

Suricata IDS/IPS Rule Writing Sysmon Event ID Analysis fast.log / eve.json

Offensive Tools

Exploitation, shells & tunneling

Netcat Socat PowerCat PowerShell Reverse Shells SSL Tunnels

Incident Response

Forensics, triage & recovery

Velociraptor (VQL) KAPE Volatility FTK Imager RCA Reporting

Threat Analysis

C2 detection & threat intelligence

C2 Beaconing DNS Tunneling MITRE ATT&CK Splunk (SIEM) Log Correlation

OS & Infrastructure

Systems hardening & virtualization

Linux (Kali/Ubuntu) Windows Server VMware ESXi Active Directory Docker

Purple Team Bootcamp

Cybersecurity Projects

Deployed Velociraptor infrastructure for large-scale endpoint monitoring and threat hunting across Windows and Linux.
Utilized VQL (Velociraptor Query Language) to hunt for persistent mechanisms like Shellbags, USN Journals, and USN artifact collection.
Automated the detection of suspicious process injections and unauthorized administrative actions using custom-built VQL artifacts.

Conducted a full Incident Response lifecycle for a simulated phishing compromise on the scholarkazim.com domain.
Performed Root Cause Analysis (RCA) identifying critical gaps in SPF/DKIM/DMARC and Multi-Factor Authentication (MFA).
Executed containment, eradication, and recovery steps while documenting the "Order of Volatility" during evidence collection.

Executed structured network reconnaissance (SYN, UDP, Service Detection) against target virtualized environments.
Correlated offensive scan traffic with Suricata IDS alerts and Zeek connection logs to evaluate blue-team visibility.
Mapped all findings and security gaps to the MITRE ATT&CK framework for strategic defense improvement.

Analyzed lateral movement techniques and simulated Mimikatz credential harvesting to test enterprise defenses.
Researched and documented LSASS memory protection mechanisms and Credential Guard configurations.
Hardened Windows Server environments using GPOs and applied security baselines according to CIS Benchmarks.

Analyzed PCAP files using Zeek and RITA to identify stealthy command-and-control (C2) beaconing patterns.
Detected sophisticated DNS tunneling techniques used for data exfiltration and persistent C2 communication.
Deployed IDS signatures to alert on suspicious non-standard port traffic and long-lived connection patterns.

Engineered high-fidelity detection rules by authoring and maintaining custom Sysmon XML configuration files.
Mapped detection logic to capture PowerShell execution, remote service creation, and remote thread injection.
Optimized log ingestion and volume in Splunk by filtering benign activity while maintaining critical visibility.

Identified persistence mechanisms including rogue scheduled tasks, malicious registry Run keys, and unauthorized local accounts.
Applied forensic methodology to reconstruct attacker timelines and entry points following a successful system compromise.
Leveraged USN Journal and Shellbag analysis to track file access history and directory traversal patterns by a threat actor.

Demonstrated advanced network pivoting techniques using Socat and Netcat to bypass segmented network boundaries.
Engineered stable reverse shells and bind shells with integrated encryption to simulate sophisticated C2 communication.
Documented detection avoidance strategies for offensive tools by analyzing traffic patterns and shell signatures.

Architected a central logging infrastructure using Splunk for real-time visibility across heterogeneous environments.
Configured Universal Forwarders and indexed network flows, IDS alerts, and endpoint event logs for unified analysis.
Developed dashboards to monitor authentication anomalies and potential brute-force attempts across the enterprise.

View All 23 Technical Reports

Career Journey

Technical Experience

2025 – 2026

Purple Team Bootcamp Participant

Intensive Hands-on Security Training

Executed 23+ technical projects covering end-to-end Purple Team operations (Threat Emulation & Incident Detection).
Mastered enterprise-grade security tools including Velociraptor, Splunk SIEM, Suricata IDS, and Zeek Network Analysis.
Engineered high-fidelity detection rules and authored detailed technical reports for every lab and phase of the program.

2022 – 2026

Customer Service & Technical Assistant

Printing & Copy Center — Karbala, Iraq

Provided structured technical support by diagnosing system, hardware, and workflow issues using a methodical troubleshooting approach
Maintained detailed ticket documentation and reported recurring issues — directly applicable to SOC ticketing and incident logging
Supported users with varying technical skill levels, ensuring clear and secure communication across all interactions

Skills & Tools

Network Security

Intrusion Detection

Offensive Tools

Incident Response

Threat Analysis

OS & Infrastructure

Cybersecurity Projects

Velociraptor Hunting & VQL Analysis

Incident Response & Root Cause Analysis

Purple Team Network Reconnaissance

Active Directory Defense & Mimikatz Research

C2 & DNS Tunneling Detection (Zeek / RITA)

Endpoint Security Engineering (Sysmon XML)

Post-System Compromise Forensics

Advanced Pivoting & Shell Engineering

SIEM Architecture & Splunk Data Orchestration

Technical Experience

Purple Team Bootcamp Participant

Customer Service & Technical Assistant

Academic Background

B.Sc. — Computer Science

High School Diploma

Get In Touch

Training & Certifications

Languages