Skip to content
View eshginallahverdiyev's full-sized avatar
3 followers · 0 following

Block or report eshginallahverdiyev

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
eshginallahverdiyev/README.md

Hi, I'm Eshgin Allahverdiyev 👋

🛡️ SOC Analyst with hands-on experience in security monitoring, alert triage, incident response, log and network traffic analysis, phishing analysis, and digital forensics. Ranked Grandmaster on HackTheBox and TryHackMe, all-time #1 in Azerbaijan on TryHackMe, and top 1% globally across cybersecurity platforms. Holds a Bachelor’s degree in Information Technology from UNEC with practical certifications including BTL1, AI1, SEC1, CRTA, AD-RTS, and has completed HackTheBox CPTS, CWES, CDSA job role paths. Built MITRE ATT&CK-mapped SOC detection labs, a static & dynamic malware analysis lab and an AI-driven SOAR workflow

🏆 Certifications

BTL1 Certificate SEC1 Certificate AI1 Certificate Certified Red Team Analyst [CRTA] Certified AD Red Team Specialist (AD-RTS)

📊 Profiles & Rankings

LinkedIn — eshginallahverdiyev
TryHackMe — Top 1% Global Ranking
BTLO — Top 1% Global Ranking
HackTheBox — Eshgin
CyberDefenders — Eshgin
LetsDefend — Eshgin
Credly — Eshgin Allahverdiyev

🔬 Home Lab Projects

🔵 AI SOC Copilot

n8n + Wazuh + Gemini AI + Threat Intelligence (VirusTotal, URLScan, AbuseIPDB, MalwareBazaar) — automated Wazuh alert triage and phishing & attachment analysis AI-generated structured verdicts with deterministic guard rails, MITRE-aware context and HTML incident reports delivered to the analyst's inbox Attack simulation with Atomic Red Team — n8n in Docker + Wazuh VM

🔵 BlackBasta Ransomware Analysis Lab

Isolated FLARE-VM lab (VMware) + Black Basta ransomware sample — static analysis (pestudio, FLOSS, capa, PE-bear), VirusTotal threat intelligence and dynamic analysis (Procmon, Regshot, FakeNet-NG) MITRE ATT&CK mapping, IOC extraction and detection engineering with 22 YARA rules, Sigma rules and KQL hunting queries

🔵 Microsoft Sentinel Defender SOC Lab

Azure VM (honeypot) + Microsoft Sentinel + Microsoft Defender for Endpoint + Kali Linux (adversary) — RDP brute-force with Hydra and MITRE ATT&CK-mapped simulation with Atomic Red Team, KQL threat hunting and full incident investigation in Defender & Sentinel

🔵 Web Threat Detection & SIEM Analysis

Ubuntu Server + Apache2 + ELK Stack (Elasticsearch, Kibana, Filebeat) Attack simulation with Kali Linux — Nmap, Gobuster, Nikto, SQL Injection via curl Full log ingestion, threat detection and analysis in Kibana Discover

🔵 SOC Home Lab

Wazuh SIEM/XDR + pfSense Firewall + Windows 11 Enterprise (target) + Kali Linux (adversary) Threat detection, incident response and security monitoring in a fully isolated virtual environment

🔵 SOC Honeypot Lab

Cowrie SSH Honeypot on Rocky Linux + Splunk SIEM Brute-force simulation with Hydra, real-time attacker behavior analysis and log investigation

Pinned Loading

  1. AI-SOC-Copilot AI-SOC-Copilot Public

    AI-assisted SOC triage: n8n workflows that enrich Wazuh alerts and suspicious emails with VirusTotal, URLScan, AbuseIPDB and MalwareBazaar threat intelligence, then use Gemini to produce structured…

    JavaScript

  2. BlackBasta-Ransomware-Analysis-Lab BlackBasta-Ransomware-Analysis-Lab Public

    End-to-end Black Basta ransomware analysis in an isolated FLARE-VM lab: static analysis, threat-intel enrichment and dynamic analysis, mapped to MITRE ATT&CK, with extracted IOCs and detection cont…

    YARA

  3. Microsoft-Sentinel-Defender-SOC-Lab Microsoft-Sentinel-Defender-SOC-Lab Public

    Hands-on SOC lab on Azure: simulated RDP brute-force & MITRE ATT&CK attack chain, detected and investigated end-to-end using Microsoft Sentinel & Defender for Endpoint.

  4. SOC-Home-Lab SOC-Home-Lab Public

    SOC Home Lab for threat detection and incident response, featuring Wazuh (SIEM/XDR), pfSense (Firewall), Kali Linux (adversary), and Windows 11 Enterprise (target).

  5. Web-Threat-Detection-SIEM-Analysis Web-Threat-Detection-SIEM-Analysis Public

    End-to-end security monitoring lab: Ubuntu Server + Apache2 + ELK Stack + Kali Linux attack simulations & log analysis.

  6. SOC-Honeypot-Lab SOC-Honeypot-Lab Public

    A hands-on SOC lab featuring a Cowrie SSH honeypot monitored by Splunk SIEM. Includes attack simulation with Hydra, threat detection, and log analysis on Rocky Linux.

    1