Who is behind the terminal, and how the work is scoped.
B.Tech Computer Science graduate (Sandip University, 2026, CGPA 8.53) working across SOC operations and offensive security. Three-month SOC Analyst internship at ESCOSS LLP deploying and administering Wazuh, implementing Splunk, and building integrations that centralised log collection across Windows and Linux endpoints.
Certified across all five modules of the SevenMentors SOC Analyst Program — Networking, Linux, CEH, WAPT and Python for SOC. The work I care about is the loop: run a controlled red-team technique in an owned lab, map it to MITRE ATT&CK, then check whether the detection stack actually fired — and write the rule when it did not.
Founder and security lead at Vrikaan, an AI threat-detection platform covering phishing and scam detection, real-time monitoring and dark-web exposure scanning. Recognised in "The Cyber 50 — India's Elite Founders List" by Indian Startup Times.
Every technique referenced here was executed inside authorised environments — my own virtualised lab hosts, DVWA, and systems I was engaged to assess. Attack simulation is always paired with the detection or hardening that answers it: that pairing is the whole point of the work, not a disclaimer on it.
- Mar–Jun 2026SOC Analyst Intern — ESCOSS LLP
Deployed and administered Wazuh, implemented Splunk, centralised logs across Windows and Linux endpoints. Monitored events, correlated logs, triaged alerts and ran incident response. Configured active response to auto-contain brute-force attempts. Certified by the COO and Director.
- 2024 – presentFounder & Security Lead — Vrikaan
AI threat-detection platform: phishing and scam detection, real-time monitoring, dark-web exposure scanning. Named in "The Cyber 50 — India's Elite Founders List".
- Aug–Sep 2023Cyber Security Intern — Academor
Nmap scanning and reconnaissance; analysed phishing, DoS/DDoS and session-hijacking techniques defensively; cryptography and ethical-hacking labs on Kali Linux.
- 2022 – 2026B.Tech CSE — Sandip University
CGPA 8.53 / 10. Final-year work: The Silent Operator, a SOC detection and red-team simulation lab.
Grouped by where the evidence comes from — certification, internship, or lab. No self-scored percentages. Anything with a number beside it is clickable: it filters the detection coverage below to the work that proves it.
- Incident response
- Vulnerability assessment
- OWASP Top 10
- Burp Suite
- Structured vulnerability reporting
- TCP/IP · DNS · DHCP · HTTP/S
- CCNA fundamentals
- Wireshark packet analysis
- Firewalls & VPN concepts
- Python · Bash · C · C++ · Java
Lab-scoped projects. Each one is something I built, broke, and then documented the fix for.
The Silent Operator
End-to-end SOC lab — Wazuh SIEM, Kali Linux, Windows 10, virtualised hosts — ingesting Sysmon and system logs from multiple endpoints into centralised dashboards. Controlled red-team attacks are executed against it, mapped to MITRE ATT&CK, then hunted from the defender side to find out what the stack missed.
- $Simulated attacks mapped technique-by-technique to ATT&CK
- $Detected via log correlation, custom alert rules, triage and threat hunting
- $Exposed detection gaps, then closed them with new rules
Techniques run in an owned lab or observed in an authorised environment, mapped to MITRE ATT&CK, then hunted from the defender side. Where nothing fired, that is recorded as a gap and the rule that closed it.
| id | technique | tactic | what was run | what caught it | status | evidence |
|---|---|---|---|---|---|---|
| T1110 | Brute Force ESCOSS internship | Credential Access | Repeated failed authentication against monitored endpoints | Wazuh alerting, with active response configured to auto-contain the source | detected | capture |
show the captureReproduced in the Silent Operator lab, 5 Sep 2026 ran: Repeated Windows logon failures from a single source against WIN-SERVER-2022 rule: 100211 · level 12 · frequency 5 / timeframe 60 · validated 2026-09-05 stayed quiet on: Isolated failures at 21:34 and 21:31 raised nothing — the threshold staying quiet on noise, which is the half usually cropped out of a screenshot.  where it shows up — public reference, not a finding
| ||||||
| T1059 | Command & Scripting Interpreter The Silent Operator | Execution | Process execution during controlled red-team simulation | Sysmon and system logs correlated in Wazuh; custom alert rules | detected | — |
| T1046 | Network Service Discovery Protocol Honeypot | Discovery | Nmap host discovery and service enumeration across the lab subnet | Honeypot and network IDS capture, correlated into actionable alerts | detected | — |
| T1190 | Exploit Public-Facing Application WAPT module | Initial Access | SQL injection against DVWA across security levels | Findings documented with remediation guidance per issue | assessed | — |
| T1071.001 | Application Layer Protocol: Web Protocol Cinema | Command & Control | Covert channel tunnelling data through public APIs, in an authorised lab | Detection logic for anomalous outbound channels derived from the observed traffic | research | — |
| T1566 | Phishing Vrikaan | Initial Access | Live phishing and social-engineering campaigns analysed | Converted into automated detection and classification logic | detected | — |
- run:
- Repeated failed authentication against monitored endpoints
- caught by:
- Wazuh alerting, with active response configured to auto-contain the source
- where:
- ESCOSS internship
show the capture
Reproduced in the Silent Operator lab, 5 Sep 2026
ran: Repeated Windows logon failures from a single source against WIN-SERVER-2022
rule: 100211 · level 12 · frequency 5 / timeframe 60 · validated 2026-09-05
stayed quiet on: Isolated failures at 21:34 and 21:31 raised nothing — the threshold staying quiet on noise, which is the half usually cropped out of a screenshot.
- ·Windows Security 4625 — a failed logon, one per attempt
- ·Windows Security 4624 — a success following a burst is the part that matters
- ·Wazuh 60122 as the base event a correlation rule counts
- run:
- Process execution during controlled red-team simulation
- caught by:
- Sysmon and system logs correlated in Wazuh; custom alert rules
- where:
- The Silent Operator
what backs this
where: The Silent Operator
drawn from: Resume: Sysmon + system log ingestion, red-team techniques detected via log correlation and custom alert rules
Nothing published here yet. A capture of the alert closes that; so does the rule that catches it and the log line it matched, which a reader can check against their own stack.
- ·Sysmon Event ID 1 — process creation, with the full command line
- ·Windows Security 4688 — process creation, where Sysmon is not deployed
- ·PowerShell 4104 — script block logging, which survives most obfuscation
- ·Parent-child anomalies: an office application or a web server spawning a shell
- run:
- Nmap host discovery and service enumeration across the lab subnet
- caught by:
- Honeypot and network IDS capture, correlated into actionable alerts
- where:
- Protocol Honeypot
what backs this
where: Protocol Honeypot
drawn from: Resume: IDS + honeypot capturing unauthorised access and reconnaissance traffic
Nothing published here yet. A capture of the alert closes that; so does the rule that catches it and the log line it matched, which a reader can check against their own stack.
- ·Sysmon Event ID 3 — network connection, one per probe
- ·One source reaching many ports, or many hosts, inside a short window
- ·Firewall or Zeek conn.log showing a fan-out that is mostly rejected connections
- run:
- SQL injection against DVWA across security levels
- caught by:
- Findings documented with remediation guidance per issue
- where:
- WAPT module
what backs this
where: WAPT module
drawn from: Resume: WAPT methodology on DVWA, SQL injection, structured vulnerability reporting with remediation guidance
Nothing published here yet. A capture of the alert closes that; so does the rule that catches it and the log line it matched, which a reader can check against their own stack.
- ·Web server access logs — unusual paths, long query strings, encoded payloads
- ·A shift in response codes from one source: a 200 among a run of 404s
- ·IDS HTTP signatures, and anything the web server process spawns afterwards
- run:
- Covert channel tunnelling data through public APIs, in an authorised lab
- caught by:
- Detection logic for anomalous outbound channels derived from the observed traffic
- where:
- Protocol Cinema
what backs this
where: Protocol Cinema
drawn from: Resume: steganographic C2 over public APIs, TTPs translated into detection logic mapped to ATT&CK
Nothing published here yet. A capture of the alert closes that; so does the rule that catches it and the log line it matched, which a reader can check against their own stack.
- ·Outbound sessions at regular intervals — beaconing is a timing pattern, not a payload one
- ·Long-lived connections to one destination moving small, even amounts of data
- ·Proxy logs: a rare user agent, or a client talking to an API nothing else uses
- run:
- Live phishing and social-engineering campaigns analysed
- caught by:
- Converted into automated detection and classification logic
- where:
- Vrikaan
what backs this
where: Vrikaan
drawn from: Resume: analysed live phishing campaigns, converted attacker techniques into automated detection and classification logic
Nothing published here yet. A capture of the alert closes that; so does the rule that catches it and the log line it matched, which a reader can check against their own stack.
- ·Mail gateway logs — sender reputation, attachment type, URL rewriting hits
- ·The click rather than the delivery: proxy or DNS resolution of the lure domain
- ·What the attachment spawns, which is where this becomes T1059
Each row cites its context in the where column — internship, a lab project, or production at Vrikaan. The reproducible parts — detection rules and the pipeline diagrams — live on the case studies. The evidence column says what backs each row. capture opens the alert firing, the rule that caught it, and what stayed quiet alongside it. rule means the detection logic is published but not a picture of it firing — checkable, and a weaker claim, so it is not called the same thing. A — means neither is published yet and the row is an assertion until one is. Rules are marked draft until they have fired against a controlled run.
A real shell, not a screenshot. Tab completes, arrows walk history, and `nmap` refuses anything outside the lab range — on purpose.
Write-ups, product notes and coverage. Links out — nothing here loads a third-party script.
1 / 5Vrikaan·Aug 2026Vrikaan is liveLaunch announcement for the platform: threat detection, fraud analysis and dark-web monitoring, built solo.
open ↗
Hiring, contract testing, or a question about something I published — all fine.
Fastest reply is email — +91 8329935878 works too. Include the role or the target scope and I will tell you straight whether I am the right fit.