Resume & Dossier•FlowCV A4 Document View
AbdelRahman Mohamed Hassan
AbdelRahman Mohamed Hassan
Junior Cyber Security Specialist
SUMMARY
Digital Forensics & Incident Response (DFIR) practitioner specializing in host artifact deconstruction, volatile memory analysis, and multi-stage attack lifecycle reconstruction across Windows and Linux environments. Proven track record tracking adversary tradecraft—correlating volatile RAM (Volatility 3), NTFS filesystem telemetry ($MFT/Prefetch), and Sysmon event pipelines to expose in-memory credential harvesting, fileless WMI persistence, and stealth rootkits. Author of 25+ reproducible forensic investigations with an emphasis on automating triage workflows in Python.
PROJECTS
Enterprise Incident Response Capstone (Operation Ghost Drift)
Lead Investigator- Reconstructed a complete enterprise APT attack lifecycle by correlating evidence across 5 operational layers: Network PCAP, RAM dump, NTFS disk image, Registry hives, and Windows Event Logs.
- Mathematically proved in-memory credential theft (LSASS dumping) by tracking Sysmon Event ID 10 with target process
lsass.exeand GrantedAccess mask0x1010. - Uncovered stealth kernel-level rootkit persistence by parsing offline SYSTEM registry hive services for rogue boot-start drivers configured for privilege escalation.
Endpoint Forensics & Threat Hunting Scenarios
Evidence Triage- Mapped attacker lateral movement and user execution trails using PECmd (Prefetch), Shellbags, and LNK Jumplist analysis to establish a definitive exfiltration timeline.
- Detected deliberate anti-forensics timestomping by calculating sub-millisecond discrepancies between NTFS
$STANDARD_INFORMATIONand$FILE_NAMEattributes. - Dissected fileless WMI malware persistence by auditing Sysmon Event IDs 19-21, isolating Base64-encoded PowerShell payloads hidden in CIM event consumers.
Memory Forensics & Network C2 Dissection
Volatile Triage- Extracted injected payloads, VAD memory hooks, and stealth unmapped DLLs from raw memory dumps using Volatility 3 plugins (
windows.pslist,windows.vadinfo,windows.malfind). - Conducted network packet analysis in Wireshark and tshark to isolate malware beacon intervals, reconstruct HTTP streams, and extract weaponized binary payloads.
CERTIFICATES & CREDENTIALS
DFIR Foundations and Techniques — Professional Skills & Readiness — Blue Cape Security
July 2026Capture The Flag Competition — Finalist & Qualification — IEEE Computer Society & NTRA (National Telecom Regulatory Authority)
October 2026H7CTF 2026 — Cybersecurity Capture The Flag — H7TEX (Sponsored by OtterSec, Payatu, JSMON, aisafe) (ID: H7CTF26 - JDUJ-CR48-J5LA)
September 2026SOC Analyst Path — Security Operations & Threat Hunting — Hack The Box (HTB)
2024 — 2026TECHNICAL SKILLS
Endpoint ForensicsNTFS $MFT, Prefetch, Shellbags, LNK Jumplists, Registry Hives, KAPE, EZTools
Memory AnalysisVolatility 2 & 3, VAD Tree Carving, DKOM, MemProcFS, WinDbg
Threat HuntingSysmon (IDs 1, 3, 10, 19-21), Hayabusa, Event Logs, Sigma Rules, Splunk
Network ForensicsWireshark, TShark, PCAP Stream Reassembly, C2 Beacon Isolation
Malware TriageGhidra, x64dbg, PE-Bear, HxD, Cryptographic Routine Deobfuscation
Scripting & ToolsPython 3 (Custom Forensic Parsers), PowerShell CLI, Bash, Timeline Explorer
EDUCATION
Higher Technological Institute (HTI) — Bachelor of Science in Computer Science
In ProgressFoundations: Computer Architecture, Operating System Internals, Data Structures & Algorithms, File Processing, TCP/IP Networking.