Muhammad Zargham

Cybersecurity professional with 4.5+ years of experience in threat detection engineering, red teaming, and threat intelligence. Skilled in simulating advanced attack techniques across Windows and Linux, developing custom EDR evasion tools, and integrating threat intelligence feeds into security platforms.

Senior Malware/Security Researcher - Ebryx LLC - Remote

(2022-09)

• Built a full Active Directory attack lab and executed 22+ AD-focused attack scenarios mapped to the MITRE ATT&CK framework, including exploits for the latest AD-related CVEs.
• Performed advanced attack simulations on Windows and Linux environments to improve CrowdStrike Falcon detection coverage, executing 79+ MITRE ATT&CK techniques based on custom requirements.
• Developed and deployed 50+ detections in Azure Sentinel, tuning detection severity levels and aligning alerts with the MITRE ATT&CK matrix and Expel taxonomy.
• Integrated security products such as Claroty xDome, Arista NDR, and Proofpoint TAP with the MDR platform using APIs and webhooks.
• Mapped telemetry from Claroty xDome, Arista NDR, and VIPRE to the Open Cybersecurity Schema Framework (OCSF) to support normalized detection logic.
• Designed and implemented kernel-space mitigations targeting local privilege escalation, arbitrary code execution, and buffer overflow attacks.
• Developed a custom dropper and injector to bypass multiple AVs/EDRs for red team activity.
• Performed quarterly internal red teaming and phishing activity using GoPhish to assess the organization's overall security posture.

Security Research Assistant - NCSAEL - Rawalpindi

(2021-10 - 2022-08)

• Validated security incidents reported by SOC L1 analysts and ensured timely escalation of alerts to meet defined SLA requirements.
• Conducted SIEM monitoring and analysis through dashboards, rules, saved searches, and reports to detect and investigate security incidents.
• Assisted in the creation and tuning of SIEM dashboards, rules, and saved searches, contributing to more efficient monitoring and reporting.
• Analyzed suspected malware samples, conducting static and dynamic analysis to assess potential threats.

B.E. - Electrical (Telecom) - National University of Sciences & Technology (NUST) (2017-10 - 2021-06)