Mohammed Aljedani
Information Technology undergraduate at King Abdulaziz University focused on Purple Team security, offensive penetration testing, and SIEM detection engineering. I build home labs to emulate adversary techniques (MITRE ATT&CK) and engineer high-signal detections.What I Work On
Combining offensive security testing with defensive telemetry analysis.
Offensive Security (Red)
Network and Active Directory enumeration, Kerberos abuse, Linux/Windows privilege escalation, and web application vulnerability testing.
Purple Team Validation
Executing controlled attack simulations mapped to MITRE ATT&CK to verify whether host sensors and SIEM queries capture the activity.
Detection & Blue Team
Analyzing Windows Event Logs, Sysmon, and PCAP traffic in Splunk and Wireshark to author practical detection rules and hardening guides.
Selected Projects & Labs
Hands-on security labs, detection pipelines, and automation scripts.
Active Directory Kerberoasting: Attack Emulation & SIEM Detection
Simulated Kerberoasting (MITRE ATT&CK T1558.003) in an isolated Active Directory lab and engineered Splunk correlation searches around Windows Event ID 4769.
Automated Phishing & Threat Intelligence IOC Triage Utility
Built a Python CLI workflow that parses suspicious email files (.eml), extracts URLs, IPs, and SHA-256 attachment hashes, and enriches them via threat intelligence APIs.
Endpoint Telemetry Validation with Sysmon & Atomic Red Team
Executed controlled credential-access and persistence tests on Windows endpoints to verify Sysmon visibility and Sigma rule coverage.
Recent Writeups & Notes
Technical notes from home lab experiments, HTB, and certification study.
Understanding & Detecting AS-REP Roasting (T1558.004) in Active Directory
A practical breakdown of how Kerberos pre-authentication abuse works, how to test for it during internal assessments, and how to detect Event ID 4768 anomalies.
Linux Privilege Escalation Notes: SUID Binaries, Capabilities & Cron Jobs
Structured study notes from CPTS and eCPPT preparation covering common Linux privilege escalation vectors and how auditd rules can catch them.
Web Application Reconnaissance & SSRF Testing Methodology
Field notes on discovering hidden parameters, testing Server-Side Request Forgery (SSRF) against internal metadata services, and implementing egress filtering.
Interested in collaborating or discussing security?
Feel free to reach out via the contact form or directly by email at mhhhmjad@gmail.com.