I studied cybersecurity and now I mostly work on detection: writing Sigma rules for Windows and checking them against real attack logs to see what they actually catch and what they miss.
Looking for my first job in a SOC or IT support team, in Kraków or remote. I have the right to work in Poland.
github.com/flexeykinDev/soc-detection-lab
Three Sigma rules tested on 278 real EVTX attack captures from a public dataset. They fired 17 times across 15 captures, including mimikatz, Meterpreter and MalSeclogon.
A few things I learned along the way:
- The LSASS rule looks at process access masks instead of file names, so it still works when a tool is renamed.
- I converted the rules to Splunk SPL and to KQL for Defender XDR. One of them didn't convert to KQL, and the README explains why.
- My first PowerShell rule had false positives on the remoting host. I narrowed it down and kept the real attacks.
-0078D4?style=flat-square){kind=icon}
Security and IT
Used in my projects
Side projects I built with AI help. I made the decisions, tested and fixed them, and got them working.
|
lumen Now-playing capsule for the Windows 11 taskbar. Works with any player, per-app volume, synced lyrics and Discord status. One portable exe. |
ShadowPlay_Patcher Tray app that stops NVIDIA Instant Replay from turning itself off on protected content. Win32 API hooking in C++. |
|
dbd-perk-randomizer · live Perk randomizer and OBS overlay for Dead by Daylight streams. Perk data is scraped from the wiki and updated by GitHub Actions. |
dota-counter-web · live Interactive map of Dota 2 counter-picks: who beats who, why, and which item shuts them down. Built from 2M+ high-rank games. |
|
steam-autolike Firefox extension that likes friends' posts in the Steam feed and leaves one emoticon comment. It stops by itself when Steam's anti-spam limit kicks in. |
thaumcraft4-1.20 Unofficial fan port of the Thaumcraft 4 mod to Minecraft 1.20.1, for Forge and NeoForge. |
Merged pull requests to other people's projects.
|
Filee · my PRs Offline file converter. I added quick clip trimming and window zoom, and fixed leftover temp folders and half-written files after a failed conversion. |
Cursed-Market · my PRs Windows proxy tool. I made it stop wiping the user's proxy settings on exit, accept only http(s) links from update responses, and warn when traffic isn't going through the proxy. |
