Detection Engineering
Proactive threat hunting and robust detection, tested against real attacks in an enterprise-style lab.
I build defensive security systems, emulate real attacks, and turn the results into stronger detections.
Certified Ethical Hacker (CEH)Issued by EC-Council, October 2025Verify credential
Select a certificate to view it full size.
Issued by EC-Council, October 2025
Credential ID ECC5142870936
Verify credentialCompleted with EC-Council, July 2025
Credential ID 762648
Verify credentialZaid Sabih and zSecurity, on Udemy
November 2023, 16 hours
Verify credential
ARGUS City
Every robot is a real ARGUS agent. Every light is backend state.
Security engineering
A local AI assistant and Windows threat monitor where every action passes a fail-closed security gate.
Detection engineering
A Python SIEM paired with an attack-simulation engine that measures whether each detection actually fires.
Operating system
A bootable Arch Linux distribution that starts straight into a cinematic hacker interface: a real root shell, live system telemetry and an AI voice that narrates the boot.
Purple team lab
An enterprise Active Directory lab for adversary emulation and SOC detection, mapping attack paths to Windows and Sysmon telemetry and MITRE ATT&CK.
46244769WinRM 9146725379Sysmon 3OpenSSH 44624Sysmon 14662Sysmon 3How I prove a detection works: attacks simulated against my own SIEM, and the Sigma rules that catch them.
Sentinel BAS ran ten Atomic Red Team tests on my lab host and matched each one to the alerts my SIEM raised, by ATT&CK technique, host and timing.
70%measured coverage
7 detected, 3 missed
A replay of the recorded run. Detected means a matching alert within 60 seconds; none was delayed.
The Kerberoasting miss exposed a rule that could never fire: it relied on TicketEncryptionType, which the pipeline never extracted.
Full results in the SIEM case studyDetects execution of well-known credential dumping tools (Mimikatz and common aliases).
detection: selection: EventID: 4688 CommandLine: - '*mimikatz*' - '*sekurlsa*' - '*lsadump*' condition: selectionDetects PowerShell invoked with an encoded (-enc / -EncodedCommand) command line.
detection: selection: EventID: 4688 CommandLine: '*-enc*' condition: selectionTechnical write-ups from my labs, published on Medium.
A Windows AI/security platform combining local models, multi-agent orchestration, controlled execution, verification, threat monitoring, and a live 3D representation of the agent runtime.
Nine attack phases, nine matching detections — red team and blue team, same person, same lab.
Somewhere in building a SIEM and an Active Directory attack lab separately, I kept hitting the same annoying question: how do I actually know a detection rule works? I could write the rule, read the code, feel confident about it — but “I…
Most “hacker OS” projects on GitHub are a themed terminal emulator running inside your regular desktop. Cool wallpaper, same OS underneath.
Not another “top 10 SIEM tools” listicle — the actual debugging notes from building one.
Cybersecurity professional specializing in detection engineering, offensive security, and security operations. CEH v13 certified, combining an attacker mindset with defensive engineering to emulate adversary techniques and build detections that improve visibility and incident response.
Hands-on experience spans Active Directory security, web exploitation, SIEM development, threat hunting, security automation, and AI systems engineering, translating attacker behavior into actionable detections using MITRE ATT&CK and Sigma.
DefendEmulateBuild
Building ARGUS (Autonomous Reconnaissance and Guardian Unified System), an actively developed local-first hybrid AI and security platform for Windows with 63,000+ lines of code. ARGUS combines multi-agent orchestration, dynamic specialist agents, local and cloud AI routing, voice interaction, Windows automation, real-time telemetry, security monitoring, policy-controlled capabilities, authentication, verification, and a live 3D AI City that visualizes agents, teams, tasks, and system activity. The system is designed around a strict security principle:
AI can decide what it wants to do, but it cannot decide whether it is allowed to do it.Built Sentinel BAS, a Breach & Attack Simulation platform that automates adversary emulation against a live AD lab and scores detection coverage against a custom SIEM per MITRE ATT&CK technique.
Engineered a custom Python/Flask SIEM with Sigma rule evaluation, multi-OS telemetry ingestion, SOAR automation, and AI-generated incident reporting.
Built an AD Purple Team lab emulating Kerberoasting, LLMNR poisoning, credential abuse, and lateral movement, analyzing Sysmon telemetry to develop and validate detections.
Investigated phishing and malware samples, extracting IOCs and building detection logic from real-world attack patterns.
From my first ethical hacking course in November 2023 to the systems I build today.
My first ethical hacking course: 16 hours with Zaid Sabih and zSecurity, on Udemy.
Verify certificateThree courses authorized by Google, on Coursera: Foundations of Cybersecurity, Play It Safe: Manage Security Risks, and Connect and Protect: Networks and Network Security.
See the certificatesCompleted the Certified Ethical Hacker course with EC-Council.
Certified by EC-Council, credential ID ECC5142870936.
Verify credentialFinished the TryHackMe learning path: 30 hours 40 minutes of hands-on labs.
Finished 1st in the TryHackMe Gold League on 19 January, then in the Platinum League on 26 January.
Finished both TryHackMe paths in one month: more than 115 hours of attack and defense labs.
Finished 1st in the TryHackMe Sapphire League on 9 February.
Built an enterprise-style Active Directory lab and ran a full attack chain, from an LLMNR broadcast to Domain Admin, with a matching detection for each of its nine phases.
Read the write-upBuilt my own SIEM from scratch, then Sentinel BAS, the attack-simulation platform that measures it: 7 of 10 techniques detected in its first run.
SIEM case studyBuilt SODIK OS, a bootable Arch Linux distribution that starts straight into its own cinematic interface.
Read the write-upBuilding ARGUS, a local-first AI security system: 63K+ lines of code and 109 test suites so far.
ARGUS case studyWrite to me about detection engineering, adversary simulation or security systems. Your message goes straight to my inbox.
Prefer email?
hello@sodik.euBased in Warsaw, Poland