121 hands-on rooms across SOC, SIEM, EDR, and blue-team practice.
View TryHackMeDavid Sarkisyan
Cybersecurity Analyst · Vulnerability Assessment · Detection
New York City
Top 1% TryHackMe · Kioptrix root path · STIGPilot on PyPI · upstream fixes
Healthcare IT taught me to respect small mistakes. Now I test boundaries, write evidence, and build security tools another analyst can verify.
STIGPilot: compare, explain, assign
pip install stigpilotdiff releaseexport ticket
Why XML hides changeOutput brief, backlog, checklistUse Jira and ServiceNow handoff
Keep the reason beside the action. Make the next step assignable.
AvailableSecurity analysis, vulnerability assessment, detection, IAM, and AppSec-adjacent work.
Best fit: testing with restraint, evidence that survives review, and handoff people can trust.
Track record
Built, shipped, reviewed.
Installable tools. Merged fixes. Public practice.
- 01Builddefensive tools
- 02Contributeupstream fixes
- 03Detectqueries and fixes
- 04Validateauthorized attack paths
- 05Documenthandoffs teams can trust
Merged and open fixes across Atomic Red Team, Splunk security_content, SigmaHQ, Elastic, and LLMForge.
View PRsPublic tools, labs, project notes, contributions, STIGPilot, and two redacted assessments.
View workIdentity cleanupDo not remove access from one stale timestamp.
STIGPilotTurn dense compliance changes into work people can assign.
Detection handoffMake the next analyst's question easier to answer.
Security testingTest inside authorized scope, then write the fixes plainly.
Featured build
STIGPilot
STIG change triage - published to PyPI
Local Python CLI for STIG release diffs, briefs, backlogs, checklists, summaries, and ticket exports.
- Published install path: pip install stigpilot.
- PowerShell-only fallback for restricted Windows environments.
- No external dependencies needed for fallback mode.
ToolPyPIDocumented
STIGGRCPythonPowerShell
STIGPilot output pathpip install stigpilot
- 01CompareDISA release files
- 02Explainchanged controls
- 03Exportbacklog and tickets
Flagged for review before remediation work is assigned.
Change brief keeps the reason beside the action.
Backlog item stays readable for technical and nontechnical review.
manager summaryreview checklistJiraServiceNow
Review method
One timestamp can lie.
lapse dry run, Entra ID stale-device review. Local only.
lapse checks device age against sign-in history. One old timestamp is not enough.
Decision ruleDevice age is a lead, not a verdict. Recent person activity turns a cleanup candidate into a review item.
- Problem
- One directory timestamp can make active access look abandoned.
- Check
- Compare device activity, ownership scope, and human sign-in context.
- Safe path
- Report first, review outliers, then decide what should change.
- Mock data.
- No tracking.
- No storage.
- No network request.
- No Microsoft Graph connection.
--days 90--company-only--skip-vdi--dry-run
dry-run excerptcompare before action
NYC-WIN-014recent devicerecent personhealthy
BK-MAC-022old devicerecent personreview
LAB-WIN-007old deviceno personstale candidate
decision
Open full stale-device testNo access change from device age alone. Human context changes the review path.
Selected work
A few pieces worth starting with, plus the full archive when you want the rest.
primary caseSecurity Testing
Kioptrix Vulnerability Assessment
Authorized Linux lab, discovery to root
Hands-on Kali assessment: discovery, SQL injection, command injection, reverse shell, root access, CVSS ratings, and a 53-page report.
Kali LinuxBurp SuiteNessusLinux privilege escalation
role:hands-on Kali testing, technical guidance, report co-author
validated:SQL injection to command execution, reverse shell, and root
reported:24 CVSS-rated findings with evidence and remediation
IdentityRiskGraph
CloudTrail IAM risk review
Groups CloudTrail IAM events, nested access paths, and ATT&CK-mapped findings into a readable risk path before analyst review.
NGINX Map Risk Audit
CVE-2026-42533 defensive triage
Source-backed review of an NGINX bug. NGINX often routes website and API traffic; this checks for a risky config pattern, with Splunk and Defender notes plus Windows and Kali evidence.
Splunk Detection Content
Validated PowerShell telemetry
Controlled T1059.001 test: 0 matching 4104 events at baseline, 1 matching 4104 event after Script Block Logging; user-scoped logging policy restored.
Open source review
Open source work.
Small upstream fixes: detection logic, scope corrections, test content, and maintainer review. All public.
- redcanaryco/atomic-red-teamView merged PR #3354Merged Atomic Red Team command fixmerged: accepted upstream PR #3354
- splunk/security_content #4116View merged PR #4116Merged broken regex alternation fixmerged: accepted upstream PR #4116
- splunk/security_content #4112View merged PR #4112Merged AD self-add field comparison fixmerged: accepted upstream PR #4112
- SigmaHQ/sigmaView merged PR #6038Merged event log clear filter-scope fixmerged: accepted upstream PR #6038
- splunk/security_content #4117View merged PR #4117Merged detection typo fixmerged: approved upstream PR #4117
- elastic/detection-rulesView PR #6253Bug fix: filter-only KQL rule exportsopen: review required, community and python labels
- SasanLabs/LLMForgeView PR #22Indirect prompt injection payload hintsopen: replacement PR after fork branch rename
Local lab
Browser Surface Check
A local browser self-check. Shows JavaScript-visible signals. Stays on your machine.
- Local only.
- No tracking.
- No storage.
- No network request.
Browser surfaceRendering checksReview note
- Surface
- screen, browser, timezone, language
- Rendering
- canvas, audio, WebGL
- Use
- compare privacy settings and browser profiles
Method
Before I trust the result.
Read the system. Compare what changed. Avoid early conclusions. Leave a cleaner note.
01Identity cleanup Do not remove access from one stale timestamp.
- Seen
- Old device activity in Entra ID.
- Check
- Interactive sign-ins, owner context, join type, management status, and dry-run output.
- Avoid
- Disabling access before person and device context agree.
- Leave
- Dry-run list with review, owner, and approval notes.
02Detection triage Persistence needs a maintenance check.
- Seen
- A scheduled task is created or changed.
- Check
- Task action, author, run context, binary path, parent process, recent logons, and maintenance windows.
- Avoid
- Calling normal endpoint management activity malicious too early.
- Leave
- Triage note with host, user, command line, and tuning detail.
03Browser review Exposure is not the same as compromise.
- Seen
- A browser or LMS workflow reveals more surface than expected.
- Check
- What JavaScript can observe, what leaves the page, account context, screenshots, and permission boundaries.
- Avoid
- Turning a privacy concern into a security claim without evidence.
- Leave
- Local-only surface note with plain-language risk boundaries.
04Network controls Convenience changes the attack path.
- Seen
- A home or lab service needs easier access.
- Check
- Ingress rules, DNS, firewall policy, admin surface exposure, backups, and recovery path.
- Avoid
- Publishing management panels just to make monitoring easier.
- Leave
- Control note with exposed surface, recovery path, and deferred work.