Detection Analysis Lab

🛡️ Zenith Phishing Incident Response

This project simulates the end-to-end detection, analysis, and response to a phishing email compromise targeting an IT company. It demonstrates skills in email forensics, SIEM analysis, and incident response reporting.

Artifacts

• Zenith_Phishing_Portfolio_Project.docx – Full report
• inbox_rules_log.csv – Simulated SIEM log data
• 2_Email_Header.txt – Phishing header metadata
• 3_Forwarding_Rules.json – Inbox rules placed by attacker
• 11_Phishing_Email.eml – Raw email
• IOC_List.csv – Indicators of Compromise
• screenshots/ – Evidence from CyberChef, VirusTotal, Splunk
• MITRE_Mapping.docx – ATT&CK breakdown

Skills Demonstrated

• Email header and link analysis
• IOC extraction and log correlation
• Splunk search simulation
• MITRE ATT&CK mapping
• Incident response documentation

MITRE Techniques

• T1566.001 – Spearphishing Link
• T1078 – Valid Accounts
• T1114.002 – Auto-forwarding Rules
• T1070.004 – Indicator Removal
• T1105 – Remote File Transfer

Summary

This case study mimics a real-world SOC investigation and is part of my cybersecurity portfolio.