Skip to content
View omarbabba779xx's full-sized avatar
57 followers · 57 following

Achievements

Achievement: QuickdrawAchievement: Pair ExtraordinaireAchievement: Pull SharkAchievement: YOLO

Achievements

Achievement: QuickdrawAchievement: Pair ExtraordinaireAchievement: Pull SharkAchievement: YOLO

Highlights

  • Pro

Block or report omarbabba779xx

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
omarbabba779xx/README.md
Omar Babba — SOC Junior / Detection Engineering

4th-year Computer Science & Networks engineering student at EMSI Tanger, focused on defensive security, SOC operations, and detection engineering. Projects centered on SIEM/SOAR, Sigma rules, MITRE ATT&CK, alert triage, log analysis and incident response — with a side specialization in blockchain security.

LinkedIn Email GitHub

SOC workflow: Ingest, Detect, Triage, Investigate, Respond, Report

Education

Cycle Ingénieur — Informatique et Réseaux · EMSI (École Marocaine des Sciences de l'Ingénieur), Tanger · 2022 – Present

  • Web/mobile security: OWASP Top 10, SQLi/XSS, APK analysis, root detection, InsecureBank/InsecureShop
  • VPN & monitoring: IPsec/IKE, OpenVPN, WireGuard, Wireshark, SNMP/Syslog, Zabbix, Prometheus
  • Incident & intrusion: SIEM/SOC, Windows/Linux logs, Sigma, MITRE ATT&CK, triage, SEC555 methodology

Experience

Cybersecurity Awareness Internship · Amendis Tangier (Groupe Veolia) · August 2025

  • Delivered fundamentals training: CIA triad, user-side risk, phishing, security best practices
  • Exposure to SCADA environments, the Riot platform, and GLPI for inventory/operational tracking
  • Ran a phishing simulation — measurable drop in click-through rate after awareness training

Projects

CyberTwin-SOC

SOC, SIEM & Detection Engineering

  • Full-stack SOC platform with OCSF ingestion
  • 4,000+ Sigma/MITRE/Elastic rules with ATT&CK coverage mapping
  • Analyst workflows, coverage scoring, rule validation

SOC SIEM Sigma MITRE ATT&CK Python Docker

APT-Simulator

MITRE ATT&CK Detection Validation

  • Lab-safe framework covering 22 ATT&CK TTPs
  • APT29 / FIN7 / Lazarus / APT41 emulation profiles
  • Reproducible JSONL SIEM traces to test alert coverage and improve Sigma rules

MITRE ATT&CK SIEM Sigma APT Docker

MediChain-plus

Blockchain Security Audit

  • Fabric + Polygon: private prescriptions, Node.js bridge, Solidity smart contract
  • Smart contract audit: 19 findings remediated, reentrancy guard added
  • CI security pipeline with Slither / Semgrep / Gitleaks

Blockchain Security Solidity Slither Semgrep Gitleaks

Skills

Area Details
SOC & Detection Engineering SIEM/SOAR, Sigma, MITRE ATT&CK, OCSF, SOC use cases, alert triage, log analysis
Incident & Intrusion Management Preparation, triage, containment, eradication, recovery, EVTX, auditd, Zeek
Network Security, VPN & Monitoring IPsec/IKE, OpenVPN, WireGuard, GRE, OSPF, SNMP, NetFlow/sFlow, Wireshark, Zabbix
Web & Mobile Security OWASP Top 10, SQLi/XSS, access control, session security, APK analysis, root detection
Blockchain Security & Smart Contracts Ethereum, Solidity, smart contracts, ERC-20/ERC-721, PoW/PoS, Slither, Semgrep, Gitleaks

SIEM & Log Management Splunk IBM QRadar Microsoft Sentinel Elastic (ELK) Graylog Wazuh

SOAR & Case Management Cortex XSOAR Shuffle TheHive MISP

IDS / NSM / Detection Engineering Suricata Zeek Snort Sigma YARA Sysmon

Forensics & Threat Hunting Velociraptor Osquery Volatility KAPE

EDR & Cloud Detection CrowdStrike Falcon Microsoft Defender Google Chronicle / SecOps

GitHub Activity

Languages: French (Advanced) · English (Advanced) · Arabic (Native)

Open to SOC analyst / detection engineering internships — reach out via LinkedIn or email above.

Pinned Loading

  1. wazuh-n8n-soc-pipeline wazuh-n8n-soc-pipeline Public

    Real-time SOC alert pipeline: Wazuh detection to deduplicated, severity-routed Gmail notifications via n8n

    Python

  2. malware-sandbox-analysis-lab malware-sandbox-analysis-lab Public

    Static and dynamic analysis of 5 real malware samples in an isolated REMnux sandbox — SOC malware-analysis portfolio project

  3. network-traffic-monitoring-lab network-traffic-monitoring-lab Public

    SOC network traffic analysis lab: 5 real malware investigations (Wireshark, tcpdump, Zeek, NetworkMiner), MITRE ATT&CK mapping, Sigma rules, IOC exports

    Python

  4. splunk-siem-detection-lab splunk-siem-detection-lab Public

    Splunk Cloud SIEM lab documenting Windows log ingestion, Sysmon forwarding, and detection searches for brute-force and PowerShell misuse.

    PowerShell

  5. APT-Simulator APT-Simulator Public

    Defensive ATT&CK emulation lab: 5,064 TTPs, 3,522 scenarios, 1,000 validated chains, 4 SIEM connectors, OIDC/JWKS RBAC, lab evidence registry, service-packaged agents, 25-area readiness, 8 enterpri…

    Python

  6. Medichain-plus Medichain-plus Public

    Full-stack dual-blockchain platform for parametric pharmaceutical micro-insurance. Hospital issues Rx on Hyperledger Fabric 2.5 → pharmacy fills → USDC paid instantly on Polygon Amoy via Solidity s…

    JavaScript