Antonio Beltran-Miller

A simulated phishing alert I triaged end to end on LetsDefend: email through the ClickFix lure, mshta LOLBin abuse, payload confirmation, containment, and a tier-2 handoff brief.

“Containing the host was not the end of it. Lumma steals session cookies, so the handoff asks for every session to be invalidated, not just a password reset.”

Confirmed true positive · full kill chain traced · host contained · tier-2 brief written

An AI-assisted detection and triage pipeline running across five VMs. I built it from MyDFIR’s SOC Automation 2.0 and extended it: Splunk ingests endpoint telemetry, n8n hands each alert to an LLM acting as a tier-1 analyst, and an MCP server lets that AI query Splunk directly to investigate.

“My first SSH brute-force rule fired on a single failed login, which is useless. Tuning it to need repeated failures from one source inside a short window, so it catches a real attack without screaming at every mistyped password, was the actual detection work.”

Cut my own triage time from 45 to 8 minutes across 10 self-run attacks