Rifdhy RM

Cyber Security Professional

About

I'm Rifdhy RM, a Cybersecurity Professional and Penetration Tester with 4+ years of hands-on experience across SOC operations, threat detection, vulnerability assessment, and offensive security.

I currently work as a Cyber Security Team Lead at Halexo, where I help manage 24/7 SOC operations, lead threat detection and incident response activities, and work with platforms such as Microsoft Sentinel and Stellar Cyber Open XDR. Alongside my SOC responsibilities, I conduct freelance web application and API penetration testing, focusing on identifying vulnerabilities and helping organizations strengthen their security posture.

Outside of professional work, I continuously build and test security labs across AWS, Azure, Active Directory, and cloud environments. I also practice penetration testing and attack techniques through Hack The Box, TryHackMe, CTFs, and personal security projects. I use these environments to sharpen my skills in offensive security, detection engineering, vulnerability research, and security automation. Labs, tools, and write-ups live on GitHub.

My technical toolkit includes Burp Suite, Nmap, Metasploit, SQLmap, Nuclei, Wireshark, BloodHound, Python, Bash, PowerShell, Microsoft Sentinel, Splunk, Wazuh, AWS, and Azure.

What started as curiosity about how systems break has grown into a career in cybersecurity. I enjoy understanding how attacks work, finding weaknesses before real attackers do, and turning those findings into practical security improvements.

Always learning. Always testing. Always looking for the next challenge.

Education

Bachelor of Computer Science (Hons) — Network Technology & Cybersecurity

Lincoln University College

Completed · 2024 Network Technology & Cybersecurity specialization

Honours-level degree pairing core computer science with a specialization in network technology and cybersecurity — covering network architecture & security, offensive/defensive security fundamentals, digital forensics, secure systems design, cryptography, and applied research. Coursework directly supports hands-on SOC operations and penetration testing work in the field.

Network Security Cybersecurity Fundamentals Digital Forensics Ethical Hacking Secure Systems Design Cryptography Research Methodology

Capabilities

Skills & Toolset

Penetration Testing 98%

Vulnerability Assessment 95%

SOC Operations & Threat Detection 95%

Networking & Routing 80%

Cloud Security (AWS / Azure) 75%

MITRE ATT&CK Tactics & Techniques 70%

Offensive Security

Burp SuiteNmapMetasploit OWASP Top 10SQLi / XSS / IDOR Active Directory AttacksKerberoastingBloodHound

Defensive Security

Microsoft SentinelStellar Cyber XDRSplunk Microsoft Defender for CloudMicrosoft Defender for Endpoint Threat HuntingIncident ResponseDetection Engineering

Cloud & Security Engineering

AWS IAMAWS GuardDutyAWS CloudTrailS3 Security Azure SentinelEntra IDRapid7 Nexpose PythonBashPowerShellSIEM Automation

Office & Leadership

Team LeadershipShift & Escalation Management Client ReportingTechnical Documentation MS Office / 365Stakeholder Communication

Currently Training

Advanced Active Directory Exploitation Cloud Security Automation (Terraform) Malware Analysis Fundamentals

Tell me any other skill you're training toward and I'll add it here.

Portfolio

Security Labs & Projects

☁️ AWS Security Monitoring Home Lab

Built a cloud-native attack & monitoring range on AWS Free Tier
Integrated CloudTrail, GuardDuty, and CloudWatch for detection coverage
Simulated brute-force and reconnaissance attacks against the environment
Wrote custom alerting rules to catch the simulated attacks

View on GitHub

🔷 Azure Security Monitoring Lab (SC-200 aligned)

Configured Microsoft Sentinel and Defender for Cloud
Built KQL queries and analytics rules for threat detection
Simulated attack scenarios and alert triage workflows
Hardened baseline configs across the Azure free-tier tenant

View on GitHub

📊 Splunk SOC Lab

Splunk-based SOC monitoring lab for SIEM operations practice
Custom searches and dashboards for threat detection
End-to-end incident investigation workflow simulation

View on GitHub

🐍 Python Automated Vulnerability Scanner

Automated scanner for web application security testing
Reconnaissance and vulnerability-finding automation
Built and maintained as a personal tool

View on GitHub

🔍 Cyrexio Scanner v7.0

AI-powered automated security assessment framework for authorized pentesting and bug bounty research
Implements OWASP Top 10 2025 exploitation techniques with finding-to-category mapping
Automates recon and vulnerability scanning, orchestrating 14 tools across 7 scan phases
Integrates Burp Suite Pro via REST API with AI-driven correlation and report generation

View on GitHub

🗝️ Active Directory Internal Pentest Lab

Home-lab Active Directory environment for internal pentest practice
Covers Kerberoasting, AS-REP roasting, and BloodHound attack-path mapping
Chains lateral movement and privilege escalation to Domain Admin
Full methodology write-up publishing soon on GitHub

View on GitHub

☁️ AWS IAM Privilege Escalation Lab

Offensive-focused lab mapping common AWS IAM misconfiguration paths
Chains overly-permissive policies into privilege escalation to admin
Documents each exploit path with remediation guidance

View on GitHub

🔷 Entra ID IAM Attack Lab

Tests common Entra ID role and conditional-access misconfigurations
Explores privilege escalation between Azure AD roles and Azure RBAC
Covers token theft, consent phishing, and app-registration abuse paths

View on GitHub

See All Labs & Projects on GitHub

Writing

From The Blog

Active Directory•

Kerberoasting in the Real World: Detection vs. Exploitation

A walkthrough of how Kerberoasting attacks actually get executed in an AD environment, and the exact Sentinel/Splunk queries used to catch them.

Read Post

Cloud Security•

Hardening an AWS Account for Under $0: A Free-Tier Security Baseline

CloudTrail, GuardDuty, and IAM guardrails you can stand up on the AWS free tier before you touch a single production workload.

Read Post

SOC•

500 Alerts a Day: How I Actually Triage a SOC Queue

The prioritization framework I use to move from raw Sentinel/Stellar Cyber alerts to a confirmed incident without drowning in noise.

Read Post

Threat Hunting•

Nightmare Eclipse Drop #9 — Shield Break: A Full Bypass of Microsoft's Patch for Rogue Planet (CVE-2026-50656)

How a threat-hunting pass through anomalous endpoint telemetry led to uncovering a patch-bypass path around a Microsoft security fix — full technical breakdown and detection guidance.

Read Post

Read All Posts

Cheat Sheets

Quick Notes

Nmap Quick Scan

nmap -sC -sV -oA scan -p- <target>

Full TCP port sweep with default scripts and version detection — first command for any new box.

Kerberoasting (Rubeus)

Rubeus.exe kerberoast /outfile:hashes.txt

Dumps requestable service-account TGS tickets for offline cracking with hashcat mode 13100.

KQL: Deep Investigation

SigninLogs
| where ResultType != "0"
| join kind=inner (DeviceLogonEvents) on $left.UserPrincipalName == $right.AccountUpn
| summarize count(), makeset(DeviceName) by UserPrincipalName, bin(TimeGenerated, 1h)

Correlates failed sign-ins with endpoint logon events for a deeper Sentinel investigation, past just spotting brute-force or spray patterns.

AWS: List Public S3 Buckets

aws s3api list-buckets --query "Buckets[].Name" | \
xargs -I{} aws s3api get-bucket-acl --bucket {}

Quick sweep to flag buckets with public-read ACLs during a cloud recon pass.

Stellar Cyber: Entity Investigation

index=alerts entity.type="host"
| stats count by entity.value, tactic, technique
| sort -count

Pivots from a single alert to every tactic and technique tied to that host, for entity-centric investigation in Stellar Cyber Open XDR.

Splunk: Lateral Movement Search

index=wineventlog EventCode=4624 Logon_Type=3
| stats dc(Destination_Host) as hosts by Account_Name
| where hosts > 5

Flags accounts authenticating network-logon (type 3) to an unusually high number of distinct hosts — a common lateral-movement tell.

View All Notes

Receipts

Proof Of Work

GitHub Activity

Live graph — pulled directly from github.com/darckshad4w, updates automatically.

Hack The Box

Pro Hacker

Rank

1,240

Points

Machines Owned

#4,821

Global Position

View live profile on Hack The Box

HTB has no public embeddable widget — swap the HTB_* placeholders above for your real numbers whenever they change, or tell me and I'll update them.

Sample Pentest Report

A sanitized, redacted sample of an actual engagement report — methodology, findings, and remediation format.

I am

Rifdhy RM

Bachelor of Computer Science (Hons) — Network Technology & Cybersecurity

Skills & Toolset

Penetration Testing 98%

Vulnerability Assessment 95%

SOC Operations & Threat Detection 95%

Networking & Routing 80%

Cloud Security (AWS / Azure) 75%

MITRE ATT&CK Tactics & Techniques 70%

Offensive Security

Defensive Security

Cloud & Security Engineering

Office & Leadership

Currently Training

Security Labs & Projects

☁️ AWS Security Monitoring Home Lab

🔷 Azure Security Monitoring Lab (SC-200 aligned)

📊 Splunk SOC Lab

🐍 Python Automated Vulnerability Scanner

🔍 Cyrexio Scanner v7.0

🗝️ Active Directory Internal Pentest Lab

☁️ AWS IAM Privilege Escalation Lab

🔷 Entra ID IAM Attack Lab

From The Blog

Kerberoasting in the Real World: Detection vs. Exploitation

Hardening an AWS Account for Under $0: A Free-Tier Security Baseline

500 Alerts a Day: How I Actually Triage a SOC Queue

Nightmare Eclipse Drop #9 — Shield Break: A Full Bypass of Microsoft's Patch for Rogue Planet (CVE-2026-50656)

Quick Notes

Nmap Quick Scan

Kerberoasting (Rubeus)

KQL: Deep Investigation

AWS: List Public S3 Buckets

Stellar Cyber: Entity Investigation

Splunk: Lateral Movement Search

Proof Of Work

GitHub Activity

Hack The Box

Sample Pentest Report

Resume / CV

Get In Touch

Location

Email

WhatsApp