Hi, I'm Felix Joo — a CS student.

Gained root access on Metasploitable2 by exploiting a vsftpd 2.3.4 backdoor using Metasploit.

Designed and deployed a Security Information and Event Management (SIEM) environment using a Wazuh cluster to monitor a Windows 10 endpoint.

Analysed a packet capture from a live SOC alert to identify an infected Windows host and attribute the infection to a Lumma Stealer C2 domain.

Independently triaged a 39 MB packet capture alongside forensic artefacts to identify an infected Windows host on an Active Directory network.

Built a Python log parser that scans event logs, detects suspicious activity mapped to MITRE ATT&CK techniques, identifies brute force attacks, and generates a formatted threat report. Includes a companion keyboard event logger sub-project.

Solved five CTF challenges across Cylab Academy and picoCTF, covering SSTI, cookie analysis, client-side auth, hash cracking, and weak RSA factorisation.

Authored a Sigma rule for Linux account discovery, converted it with pySigma, and validated it end-to-end through an auditd → Filebeat → Wazuh pipeline.