Hey there! I'm Dan, a cybersecurity analyst who believes the best way to learn security is to break things (in a lab, of course).
This portfolio is a collection of hands-on projects where I've built, configured, analyzed, and occasionally troubleshot my way through various security tools and scenarios. No fluff, just real technical work.
My second Splunk lab - built a full SIEM environment from scratch. Collected 350,000+ security events, configured forwarders, and learned why firewall rules matter the hard way.
Tech: Splunk Enterprise, Universal Forwarder, VirtualBox, Windows 11, Kali Linux
First dive into Splunk. Analyzed the BOTS v3 dataset, investigated a Cerber ransomware attack, and wrote way too many SPL queries.
Tech: Splunk, SPL, BOTS Dataset, Incident Response
Automated the Tier-1 phishing triage grind into a Python tool — drop in a raw .eml and it scores the message, maps every finding to MITRE ATT&CK, and writes an analyst-ready report (Markdown/JSON/HTML). 25 weighted detection rules covering spoofed authentication (SPF/DKIM/DMARC), look-alike and homoglyph domains, link manipulation, malicious attachments, and BEC/reward-scam language. Offline by default, 30 passing tests with a detection-regression suite, and CI on every push. Bonus: I tuned it against a real phish that hit my own inbox.
Tech: Python, MITRE ATT&CK, Email/MIME parsing, Detection-as-Code, pytest, GitHub Actions
A one-command, Docker-based Splunk lab that proves those detections fire against a live SIEM, not just in unit tests. It stands up Splunk as code (index, HEC input, saved searches), ingests a synthetic 8-technique Sysmon intrusion plus benign noise over the HTTP Event Collector, then runs the compiled Sigma/SPL detections through Splunk's REST API and reports which fired. The live-validation half of the Sigma project: write the rules, test them offline, then confirm they trigger on real ingested data.
Tech: Splunk, Docker Compose, Sysmon, Sigma, HEC, REST API, Python, MITRE ATT&CK
Treated detection rules like real software: 8 Windows/Sysmon Sigma rules (9 MITRE ATT&CK techniques) that are validated, unit-tested against true-positive/false-positive events, and auto-compiled to Splunk SPL by CI. The centerpiece is a from-scratch offline Sigma matcher, so every rule is regression-tested (does it catch the attack and ignore the benign look-alike?) with no SIEM required. Change a rule and CI tells you in seconds whether detection coverage broke.
Tech: Sigma, pySigma, Splunk SPL, Python, MITRE ATT&CK, pytest, GitHub Actions, Detection-as-Code
Automated network scanning scripts. Why click when you can script?
Tech: Nmap, Python/Bash, Network Discovery
Vulnerability scanning and SIEM integration. Because finding vulnerabilities is only half the battle - you need to monitor them too.
Tech: Vulnerability Scanning, SIEM Integration
Playing with encryption, hashing, and cryptographic algorithms. The math is hard, but the implementations are fun.
Tech: Cryptography, Python, Encryption Algorithms
Understanding and implementing digital signatures. Trust, but verify.
Tech: PKI, Digital Signatures, Cryptographic Verification
An educational project exploring how keyloggers work. Built for learning, not for evil.
Tech: Python, Security Research, Ethical Hacking
I'm a hands-on learner. I don't just read about security tools - I install them, break them, fix them, and document the whole process. This portfolio isn't polished marketing material; it's real work from someone who's constantly learning and building.
If you're into practical cybersecurity, SIEM analysis, threat detection, or just enjoy seeing someone figure things out through trial and error, you're in the right place.
SIEM & Monitoring: Splunk (Enterprise & Forwarder), Log Analysis, SPL
Security Operations: Threat Detection, Incident Response, IOC Analysis
Network Security: Nmap, Network Scanning, Traffic Analysis
Vulnerability Management: Scanning, Assessment, Remediation
Scripting & Automation: Python, Bash, PowerShell
Cryptography: Encryption, Hashing, Digital Signatures
Platforms: Windows, Linux (Kali, Ubuntu), VirtualBox
- GitHub: DMYourz
- LinkedIn: DMYourz
- Email: danielmochkarovsky@gmail.com
All projects here are for educational purposes and conducted in isolated lab environments. No production systems were harmed in the making of this portfolio.
"Security is a process, not a product." - Bruce Schneier
Also, backups are important. Trust me on this one.