Kwasi Appiah Dankwa

Live SIEM: Self-Built Security Operations Centre (SOC) and Detection Engineering Lab

Home lab | Wazuh, Suricata, Python | Ongoing

• Designed, built and now operates a continuously running Wazuh and Suricata detection platform across a macOS sensor host, a Windows 11 virtual machine and a dedicated SIEM server, authoring 30 custom Suricata signatures and roughly 125 custom Wazuh rules organised by attack stage into reconnaissance, application abuse, access and exfiltration categories, layered on a 49,920-rule Emerging Threats Open baseline.
• Built threat intelligence pipelines in Python that pull AlienVault OTX pulse indicators and the OpenPhish feed into Suricata datasets and Wazuh CDB lists consumed directly by detection rules, added VirusTotal enrichment on file events, and extended the SIEM ingest pipeline with source and destination GeoIP enrichment that the stock pipeline left uncovered for Suricata dual-IP fields.
• Performed a detection gap assessment after live Nmap reconnaissance went entirely undetected, tracing the failure to an exact TCP flag match that never matched SYN packets carrying ECN bits and to a protected host absent from both the rule set and HOME_NET, then rewrote and positive-tested every affected rule against live Kali Linux attack traffic in a purple team validation loop.
• Reviewed 200,099 alerts across a 24-hour window, isolated a single mis-scoped rule generating 171,572 false positives at 85% of total volume, and applied threshold and suppression tuning so genuine signal was not buried.
• Wrote a Python collector converting Wazuh vulnerability state documents into alerts after finding that 46 unpatched critical CVEs on a monitored host had gone unreported for 16 days once vulnerability detection was removed from the alert pipeline.
• Authored file integrity monitoring (FIM) and registry persistence escalation rules covering LaunchDaemons, startup and Run keys, scheduled tasks, hosts file and security agent tampering, plus Windows firewall correlation rules for scan and brute-force candidates.
• Automated deployment and scheduling with zsh and launchd agents, kept API keys out of the repository, and applied AI-assisted coding tools throughout to accelerate rule, script and dashboard development, recording every change, validation and verification step in a written engineering report.

Post-Incident Log Analysis and Threat Timeline Reconstruction

Capstone project | Three-person team

• Investigated a multi-stage enterprise breach in a three-person capstone team, correlating Sysmon, Windows Security, and Zeek network logs in Kibana (ELK) across a 476,804-event activity spike to isolate the compromised hosts, accounts, and external infrastructure.
• Reconstructed the full attack chain and mapped each stage to the MITRE ATT&CK framework, including PowerShell and rundll32 proxy execution (T1059.001, T1218.011), process injection (T1055), WinRM and RDP lateral movement (T1021.006, T1021.001), and LSASS credential dumping (T1003.001).
• Identified the external command and control server and a rogue local administrator account created for persistence, filtered benign telemetry to remove false positives, and documented an IOC timeline with remediation recommendations.

Digital Forensic Investigation and Malware Analysis

Formal case engagement

• Investigated a multi-host domain compromise across disk and memory images in a formal case engagement, verifying MD5 hashes for all 11 evidence files against reference values, holding original acquisitions read-only and analysing only separate working copies to preserve evidentiary integrity and chain of custody.
• Established the intrusion vector as an internet-exposed RDP service brute-forced from an external host, corroborating the successful logon across packet capture, Windows Security event logs (4625 failed logon burst, 4624 Logon Type 10, 4672 privilege assignment) and Terminal Services Operational logs.
• Analyzed the malicious binary coreupdater.exe with Volatility 3 (pslist, netscan, malfind), identifying process injection into spoolsv.exe and powershell.exe, encrypted command-and-control (C2) over port 443, and dual persistence through a Windows service and a fileless Base64 PowerShell registry loader.
• Reconstructed the full incident timeline from the $MFT and $UsnJrnl change journal, registry hives, event logs and packet capture using Autopsy, FTK Imager, EvtxECmd and MFTECmd, normalising all timestamps to a single timezone.
• Produced a formal forensic investigation report with executive summary, per-finding evidence citations and architecture hardening recommendations, addressing all 13 client investigation questions.

Vulnerability Management and Honeypot Deployment

Group lead

• Conducted a vulnerability assessment of Windows Server 2019 using Nessus, identifying high-risk CVEs with CVSS scores above 8.5 and eliminating false positives as group lead.
• Produced executive and technical remediation reports, mapping vulnerabilities to mitigation actions and prioritizing fixes by risk.
• Deployed a Windows 10 honeypot to capture reconnaissance and attack activity, including SYN and TCP scan attempts.

Site-to-Site IPsec VPN and Firewall Security

Group lead

• Configured FortiGate firewalls to establish site-to-site IPsec VPNs between offices over untrusted networks, validating encrypted inter-office traffic as group lead.
• Implemented LAN-to-WAN firewall policies for secure internet access with correct routing and NAT configuration.
• Applied security profiles, including antivirus inspection, application control, and URL filtering aligned to business rules.

Secure File Exchange with PKI

Group lead

• Designed and operated a Public Key Infrastructure (PKI) using OpenSSL, issuing and managing X.509 certificates with key usage and CRL distribution as group lead.
• Enforced certificate validation by verifying trust chains against a root CA and performing revocation and expiration checks via CRLs.
• Built a secure asynchronous file exchange system combining encryption and digital signatures for confidentiality, integrity, authenticity, and non-repudiation.

Data Center Business Continuity and Disaster Recovery Plan

Five-person consulting team

• Built a business continuity plan for a Winnipeg data center in a five-person consulting team, ranking five critical business functions by dependency so that facilities, information systems, and hosting recovery sequenced in the correct order.
• Set recovery targets of a 4-hour RTO and 1-hour RPO for three tier-1 functions against a 24-hour maximum tolerable downtime, establishing that continuous replication rather than nightly backup was required to defend a 48 to 72 hour restoration SLA.
• Specified the recovery architecture and validation regime, covering VMware vSphere HA, replication and backup tooling, geographic site failover, quarterly restore drills, and annual full failover testing.

Web Application Penetration Test

Authorized lab scope

• Performed black-box web application penetration tests against Linux targets (a WordPress site and a PwnLab intranet application), following a full reconnaissance, enumeration, exploitation, and post-exploitation workflow within authorized lab scope.
• Enumerated services and content with Nmap, Nikto, Gobuster, WhatWeb, and enum4linux-ng, then used Burp Suite to intercept the authenticated upload workflow and manually validate findings beyond automated scanning.
• Exploited an anonymous SMB share to recover plaintext credentials, achieved authenticated remote code execution through WordPress plugin upload with Metasploit, and escalated to root via password reuse and permissive sudo.
• Identified a local file-read configuration-disclosure flaw and reversible Base64 password storage, decoded database credentials to confirm account takeover, and mapped weaknesses to the OWASP Top 10.
• Produced structured reports documenting each finding with root cause, CIA and business impact, CVSS-based severity, and practical remediation.

Network Infrastructure Penetration Test and Pivoting

Authorized lab scope

• Conducted a penetration test against a two-tier segmented network, enumerating a dual-homed Windows 10 host over SMB, RDP, and WinRM with Nmap and searchsploit to map the attack surface and select an exploit.
• Gained initial access by generating a malicious PDF payload in Metasploit, delivering it to a writable SMB share, and capturing a Meterpreter reverse shell as the logged-on user.
• Established a pivot into an isolated internal subnet using Metasploit autoroute and a SOCKS proxy to reach a file server with no direct route from the attacker host, documenting the attack path and identified security gaps.

Red Team Web Application Assessment

Group engagement

• Delivered a red team assessment of an enterprise webmail and collaboration application in a group engagement, structured as Discover, Simulate, and Report phases to model real-world attacker behavior.
• Identified stored XSS enabling phishing and account takeover, session-management weaknesses, username enumeration and brute-force exposure, and vulnerable third-party libraries (CKEditor, Lodash).
• Mapped findings to the MITRE ATT&CK framework and produced an executive report translating each weakness into business impact, risk rating, named action owners, and prioritized remediation.

Apache Tomcat Server Compromise and Manager API Testing

Authorized penetration test

• Performed an authorized penetration test of an Apache Tomcat 9.0.53 application server, using Nmap and Gobuster to enumerate the service and discover an exposed backup archive in the web root.
• Cracked the archive password with fcrackzip and recovered Tomcat Manager credentials from tomcat-users.xml, then authenticated to the Tomcat Manager management interface and assessed its text-based deployment API, which restricted scripted deployment.
• Achieved remote code execution by deploying a malicious WAR payload through the Manager deployment endpoint with Metasploit, obtaining a Meterpreter shell, then escalated through a SUID binary and cracked a user hash with John the Ripper.

Long-Term Service Agreement, Volta River Authority Power Plant

C$15.5M | Started 2011

• Managed maintenance and reliability programs for two gas-fired GE Frame 9 turbines.
• Confirmed compliance with operational and performance standards across the agreement term.

SCADA and Distributed Control System Upgrade, Volta River Authority

C$4M

• Upgraded the distributed control system at the Akosombo hydro power plant for improved automation integration.
• Collaborated with Hatch Consulting on engineering execution.

LV Bifurcation Deployment and Network Improvement, Ghana

C$5M combined with the Power Factor Correction program

• Managed asset procurement and deployment across 10 key districts, improving power distribution efficiency.
• Procured MV/LV transformers, 50 switchgear main ring units, and 1000 km of conductors, enhancing power reliability for 400,000 clients.

Power Factor Correction and Network Improvement, Accra East

Included in the C$5M combined procurement value

• Optimized voltage regulation and minimized system energy losses across the distribution network.

33/11kV SCADA MV Distribution Substation

C$0.8M

• Managed procurement and execution, resolving commissioning challenges to achieve uninterrupted power distribution.

Fiber Optic Service Mapping, Comcast

C$2.7M

• Led GIS-based geospatial planning and network mapping across a 723 square mile service area.
• Designed connection pathways using GIS tools including ArcGIS and Google Earth for precise route planning.

Cable TV and Communication Network Pathways, Spectrum

C$6.8M

• Designed new large-scale connection infrastructure for Texas-based multi-city and rural projects.
• Conducted multi-state network surveys to mitigate system failures and improve service reliability.

Nestle Factory Expansion

C$500K

• Designed and optimized electrical systems covering step-down transformers, medium-voltage switchgear, and variable speed drive packages.

GIS 255kV Live Tank Circuit Breaker Service Agreement, Gridco

C$500K | Two-year agreement

• Maintained operational reliability through a planned maintenance program.

Medium-Voltage Protection and Control System Service, A.P. Moller

C$600K

• Delivered protection and control system servicing for medium-voltage installations.

Generator Circuit Breaker Spare Parts, TAQA

C$300K

• Managed procurement and installation of generator circuit breaker spare parts.

Postgraduate Certificate, Cyber Security Analysis

Algonquin College, Ottawa, ON · GPA 3.45 / 4.02025 – 2026

Transcript available on request.

Project Management (MEM 6260)

University of Ottawa, Management streamFall 2024

Graduate course in the Master of Engineering Management stream, covering project cost estimation, learning curve theory, resource planning, and project completion uncertainty.

Transcript available on request.

Project Management Toolkit for Success

World Skills Employment Centre, Ottawa, ON · 35 hoursFeb 2025

Delivered with support from the RBC Foundation.

Certificate available on request.

BSc, Electrical and Electronic Engineering

Regional Maritime University, Ghana · GPA 3.34 / 4.0 · WES-assessed2004 – 2008