A skill, applied

SQL Server security

I followed up on SQL Server xp_cmdshell abuse by checking endpoint monitoring coverage and building an alert for a command shell spawned from the SQL Server process.

Experience at UK Water Utility

UK Water Utility

Turn Red Team findings into detection and hardening

Threat-Informed Detection Engineering

Turned Red Team findings into SQL and SMB detections, credential hunting and identity hardening, as part of wider work building over 15 detections and tuning over 50 alerts, primarily individual instances and associated metadata.

Read the story

Related skills

MITRE ATT&CK Detection use-case development Attack-path analysis Telemetry requirements Security risk prioritisation KQL Microsoft Defender XDR SMB enumeration detection Credential exposure hunting Threat hunting Active Directory NTLM authentication Detection tuning & alert context

SQL Server security

Turn Red Team findings into detection and hardening

Viewed history

Ask about my work.

Report an issue