Skip to content
View ibernal1815's full-sized avatar
3 followers · 1 following

Achievements

Achievement: Pull Shark

Achievements

Achievement: Pull Shark

Block or report ibernal1815

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
ibernal1815/README.md

Isaiah Bernal

Typing SVG

LinkedIn Security+ CySA+ ISC2 CC In Progress

Security engineer with a background in IT infrastructure, focused on dissecting malicious behavior across Windows internals, volatile memory, network traffic, and endpoint telemetry. I build isolated virtualization labs around RHEL, KVM/QEMU, libvirt, and containers for adversary emulation and binary detonation, backed by custom Python tooling for log normalization, IOC extraction, and automated threat intelligence enrichment.


Technical Arsenal

Languages & Development

Malware Analysis & DFIR

Detection Engineering & Offensive Security

Infrastructure & Virtualization


Featured Engineering & Labs

Repository Architecture & Focus Core Stack Status
Log Normalizer / IOC Extractor Automated EVTX parsing, log normalization, regex IOC extraction, and structured JSON output Python python-evtx Regex pytest Complete
Threat Intel Enricher Automated IOC enrichment, multi-source verdict scoring, and persistent intelligence pipelines Python VirusTotal AbuseIPDB PostgreSQL Complete
Enterprise Active Directory Lab Tiered domain administration, GPO hardening, PowerShell provisioning, and attack simulation Windows Server AD DS PowerShell Complete
Python Keylogger with C2 Low-level keystroke capture, AES-encrypted staging, HTTP C2 exfiltration, and modular unit tests Python Flask AES pytest Complete
SQL Security Lab SQL injection exploitation and remediation via parameterized queries, RBAC, and row-level security Python Flask PostgreSQL Complete
Sysmon Detection Lab ATT&CK adversary simulation, Sysmon telemetry analysis, Sigma rules, and SIEM detection engineering Sysmon Sigma Elastic Wazuh Active Build
Windows Internals Lab Process/thread structures, virtual memory inspection, persistence mechanics, and forensic artifacts Windows WinDbg Sysinternals Volatility Active Build
Malware Analysis Lab Isolated static/dynamic detonation environment, memory forensics, and custom network emulation RHEL KVM/QEMU libvirt FLARE-VM REMnux Rebuilding

Academic Credentials

Credential & Focus Institution Status
MS Cybersecurity & Information Assurance
Focus: Secure Systems Architecture, Penetration Testing, & DFIR		 Western Governors University Expected 2027
BS Computer Information Technology
Focus: Systems Engineering, Network Infrastructure, & Enterprise Administration		 California State University, Northridge Completed 2026
AS Cybersecurity & Computer Programming
Focus: Software Development Foundations, Network Defense, & Scripting		 Los Angeles Mission College Completed 2024

Footer Quote

Pinned Loading

  1. malware-analysis-lab malware-analysis-lab Public

    A structured malware analysis lab covering static analysis, dynamic behavioral analysis, memory forensics, and detection engineering with Sigma and Wazuh.

    1

  2. threat-intel-enricher threat-intel-enricher Public

    CLI tool that enriches IOCs against VirusTotal and AbuseIPDB and outputs a structured JSON threat intel report.

    Python

  3. active-directory-lab active-directory-lab Public

    Simulated enterprise Active Directory environment for Silverline Technologies — covering AD DS, DNS, GPOs, file permissions, PowerShell automation, and IT support workflows.

    PowerShell

  4. sysmon-sysinternals-detection-lab sysmon-sysinternals-detection-lab Public

    Detection engineering lab using Sysmon and Sysinternals to identify attacker TTPs, map to MITRE ATT&CK, and build detection logic.

  5. python-keylogger python-keylogger Public

    Modular Python keylogger with AES-encrypted keystroke transmission, screenshot capture, and a Flask-based C2 server — built for adversarial simulation and endpoint detection research.

    Python