Cybersecurity Capstone
CYBER 440 was a cybersecurity capstone focused on investigating a simulated organizational compromise. The project required connecting phishing activity, malware behavior, forensic images, memory artifacts, network traffic, Windows logs, operational impact, and remediation planning into one incident response narrative.
Project Summary#
Overview#
CYBER 440 was a cybersecurity capstone course focused on investigating a simulated organizational compromise using multiple evidence sources and analyst workflows.
Unlike a single isolated lab, this project required building a full incident story. The value was not only finding individual artifacts. The value was connecting those artifacts into a clear explanation of what happened, how it happened, which systems were affected, what impact occurred, and what actions should be taken next.
The investigation required correlating evidence from:
- network captures
- forensic system images
- Windows event logs
- memory artifacts
- suspicious processes
- user activity
- email-based compromise indicators
- ransomware-style artifacts
- malware-related findings
- timeline reconstruction
- business impact analysis
- remediation recommendations
This page focuses on methodology, analysis process, investigation workflow, and lessons learned. Raw forensic evidence, memory dumps, screenshots, account information, academic submissions, and sensitive artifacts are intentionally excluded.
Why This Project Matters#
This is one of the strongest academic projects in my portfolio because it required a complete investigation workflow.
A realistic incident is rarely solved by one artifact. Analysts have to combine multiple views of the same event:
- what happened on the network
- what happened on endpoints
- what changed on disk
- what was visible in memory
- what logs support the timeline
- which systems and users were affected
- which attack vector was most likely
- what operational impact occurred
- what should happen next
The project also required communication. Findings had to be converted into status reporting and final reporting that explained the incident, impact, and remediation path in a way a reviewer could understand.
That makes this page especially relevant for cybersecurity analyst, incident response, forensic analysis, vulnerability management, and ServiceNow SecOps conversations.
Scenario Summary#
The capstone scenario involved a simulated compromise affecting multiple organizational systems.
The investigation pointed to a phishing-led attack path involving a malicious file disguised as a PDF attachment. The suspected infection chain led to malware execution, suspicious processes, remote-access risk, file deletion, ransom-note artifacts, exposed credentials, failed authentication events, and operational disruption.
The strongest working theory was that a phishing email introduced malware into the environment, after which the compromise affected multiple systems and required coordinated incident response.
Portfolio-Safe Redaction Approach#
Security note: This case study intentionally avoids publishing raw forensic images, packet captures, screenshots, hashes, complete usernames, full email artifacts, private academic files, or step-by-step evidence extraction details.
This page excludes:
- raw forensic images
- packet capture files
- memory dumps
- full screenshots
- complete raw logs
- exact hashes
- private student identifiers
- full team submissions
- complete academic answers
- sensitive simulated evidence artifacts
- step-by-step replication instructions
Instead, it summarizes:
- investigation workflow
- evidence categories
- technical themes
- analyst reasoning
- incident timeline concepts
- impact assessment
- remediation thinking
- professional lessons learned
Investigation Workflow#
Scope the Evidence#
Reviewed available evidence sources and identified the major analysis tracks: network traffic, forensic images, memory artifacts, and Windows/event log data.
Scope
Analyze Network Activity#
Reviewed network captures to understand communication timelines, suspicious email activity, credential exposure concerns, affected systems, and event sequencing.
Network Forensics
Review Forensic Images#
Analyzed Windows system images, user directories, downloads, desktop artifacts, application history, suspicious files, and system folders relevant to the compromise.
Disk Forensics
Review Memory Artifacts#
Reviewed memory-related findings to identify suspicious processes, unknown parent-child process relationships, possible hands-on-keyboard activity, and incomplete or obfuscated process metadata.
Memory Analysis
Correlate Logs#
Analyzed Windows and server log evidence for failed authentication, anonymous access attempts, service state changes, PTR registration issues, audit failures, and access-related anomalies.
Log Analysis
Assess Impact and Recommend Remediation#
Translated technical findings into operational impact, risk exposure, containment priorities, restoration recommendations, and future prevention steps.
Remediation
Evidence Areas#
Phishing-Led Compromise#
The investigation identified a phishing-style email with a malicious attachment disguised as a PDF as the likely initial compromise path.
Initial Access
Malware Execution#
The analysis connected suspicious file activity to malware execution and remote-access risk, including backdoor-style behavior and potential credential exposure.
Malware Investigation
Forensic Image Review#
Forensic images were reviewed for user directories, desktop artifacts, suspicious downloads, temp folders, application history, event logs, and evidence of encrypted or suspicious files.
Disk Forensics
Memory Artifacts#
Memory analysis identified suspicious processes, unusual process relationships, missing or incomplete metadata, and indicators that required further investigation.
Memory Analysis
Windows and Server Logs#
Log review focused on authentication failures, service state changes, PTR registration issues, anonymous access attempts, and server-management anomalies.
Log Analysis
Incident Reporting#
Findings were summarized into status reports and a final incident report with executive summary, attack vector analysis, impact assessment, and remediation recommendations.
Reporting
Network Analysis Themes#
Network analysis focused on communication patterns and timeline evidence.
Key activities included:
- reviewing network capture time ranges
- identifying email-related activity
- supporting the incident timeline
- looking for suspicious communication patterns
- connecting network evidence to endpoint findings
- identifying potential credential exposure concerns
- mapping communications between affected users and systems
The network evidence helped support the conclusion that the incident was connected to a malicious file delivered through email rather than a simple port manipulation issue.
Forensic Image Analysis Themes#
Forensic image analysis focused on endpoint artifacts.
Areas reviewed included:
- user profile directories
- Documents, Downloads, Desktop, and Pictures folders
- Windows system folders
- temporary files
- suspicious executables
- browser and application history
- encrypted or suspicious files
- Windows event log artifacts
- hash verification to confirm image integrity
This part of the work helped connect user activity, suspicious files, ransomware-style artifacts, and endpoint-level evidence to the broader incident timeline.
Memory Analysis Themes#
Memory analysis focused on volatile artifacts and running processes.
The investigation considered:
- suspicious process names
- unknown or missing process metadata
- suspicious parent-child process relationships
- command-line visibility
- process timing
- possible hands-on-keyboard indicators
- potential process obfuscation
- malicious or unknown executable behavior
This reinforced the importance of memory analysis in incident response because disk evidence alone may not fully explain what was happening at runtime.
Log Analysis Themes#
Log analysis focused on Windows and server events.
The work included review of:
- failed authentication
- anonymous access attempts
- service start/stop behavior
- PTR registration errors
- audit failures
- network share access attempts
- server-management errors
- suspicious timing correlations
- affected Windows and Windows Server systems
Log evidence helped translate individual artifacts into a broader operational picture.
Impact Assessment#
The incident created risk across several dimensions.
Remediation Recommendations#
The capstone response emphasized both immediate containment and long-term security improvement.
Recommended actions included:
- isolate affected systems
- preserve evidence for forensic review
- conduct complete forensic analysis
- identify all compromised accounts and processes
- remove malware and unauthorized processes
- reset affected passwords
- strengthen authentication
- improve network monitoring
- update security policies
- conduct security awareness training
- perform recurring vulnerability assessments
- update the incident response plan
- document lessons learned
- communicate clearly with stakeholders during recovery
These recommendations matter because they connect technical findings to operational decision-making.
Capability-to-Evidence Map#
What I Learned#
What surprised me most during this project was how difficult it was to build a reliable incident timeline from incomplete evidence.
At the beginning of the investigation, I found myself looking for a single decisive artifact that would explain the compromise. As the project progressed, I realized that incident response rarely works that way. The strongest conclusions came from combining multiple independent sources of evidence rather than relying on any one indicator.
The phishing email initially appeared to be the most important artifact. Later, the value came from understanding how network activity, forensic images, Windows logs, memory artifacts, suspicious processes, and user behavior fit together into a larger story. The challenge was not simply identifying individual indicators. The challenge was determining how confident I could be in the conclusions supported by those indicators.
Another lesson was how important communication becomes during an investigation. Technical findings only become useful when they can be explained clearly to decision-makers. A timeline, impact assessment, or remediation recommendation has very little value if stakeholders cannot understand what happened or why a particular action is necessary.
The biggest takeaway I carried forward from CYBER 440 is that strong cybersecurity analysis is not about finding a single “smoking gun.” It is about building confidence through evidence correlation, documenting assumptions, understanding uncertainty, and making defensible decisions with the information available.
That mindset continues to influence how I think about cybersecurity operations, vulnerability management, and ServiceNow SecOps workflows today.
Professional Relevance#
This is one of the projects I would point to first for cybersecurity analyst, incident response, forensic analysis, and security operations conversations.
It also supports my ServiceNow SecOps direction because incident response and Vulnerability Response both require structured triage, ownership, remediation tracking, validation, documentation, and stakeholder communication.
The professional value is not just the tool exposure. The value is the workflow: take messy evidence, understand what happened, explain impact, recommend action, and document the outcome.
Portfolio-Safe Redaction Notes#
This case study intentionally excludes:
- raw forensic images
- raw packet captures
- memory dumps
- private screenshots
- complete raw logs
- exact hashes
- private user details
- full academic submissions
- full team report content
- step-by-step evidence extraction details
The goal is to show investigation workflow, reasoning, and security communication without exposing raw evidence or sensitive academic materials.
Related Portfolio Areas#
Security Operations#
This capstone supports SOC-style work through triage, evidence review, timeline reconstruction, and escalation-oriented reporting.
SOC-Relevant
Digital Forensics#
The project included forensic image review, endpoint artifact analysis, application history review, suspicious files, and event log review.
Forensics
Incident Response#
The project required identifying the compromise mechanism, affected systems, operational impact, and immediate/long-term remediation steps.
Incident Response
ServiceNow SecOps#
The workflow maps naturally to SecOps concepts such as incident triage, ownership, remediation tracking, documentation, and validation.
SecOps-Relevant
Next Steps#
This capstone could later be expanded with:
- a sanitized incident timeline diagram
- a portfolio-safe IR lifecycle diagram
- a detection-to-remediation workflow map
- a ServiceNow Security Incident Response mapping concept
- a lessons-learned table
- a mock executive incident report template
For now, this page serves as the main portfolio-safe summary of my CYBER 440 cybersecurity capstone work.