 |
 |
3rd-year CS student who spends his nights in Splunk instead of on rooftops.
Four months in a real SOC pulling apart Bandook RAT and TrickBot traffic, writing the
detections nobody else wanted to tune, and learning that the alert everybody ignores is the one that matters.
Caught in the web: a false positive nobody had noticed — service account noise firing a privilege-escalation rule. Found it, fixed it, kept the detection.
Cross-platform EVTX analyser in Python with 5 correlated rules (brute force, LOLBin execution, privilege-escalation sequencing, alternate credential use, account modification), tested against 28,000+ real events on Windows 11 and Kali. Confidence scoring, MITRE ATT&CK mapping, SQLite persistence, interactive HTML dashboard — no SIEM required.
Caught in the web: dual C2 infrastructure that DNS-only monitoring missed entirely — a hardcoded IP reached out 37 minutes before any DNS activity.
Full IOC extraction and ATT&CK mapping across
T1071,T1571,T1573,T1568.
Caught in the web: a real SSH credential attempt against the honeypot — logged, detected, and written up end to end.
Splunk + Wazuh SOC lab on Kali and VMware Workstation, with an OpenCanary honeypot in a segmented DMZ isolated via
iptables(TCP 6591). Detections built for brute force and lateral movement.
Caught in the web: PowerShell execution, failed auth, account creation and service installation — all validated against real Windows telemetry, not synthetic samples.
Documented SPL queries with MITRE mapping for every rule.
| SOC Analyst Training Gardiyan System Security Technologies · Turkey (remote) |
Sep 2025 – Jan 2026 |
 Hackfinity Battle CTFRank 265 · 600 pts |
2025 |
| B.Tech, Computer Science Engineering Poornima University, Jaipur |
Expected 2028 |
with great logs comes great responsibility