SOC Analyst / Security Operations — hands-on detection, investigation & incident response
Bengaluru, India · LinkedIn · prapul.2004@gmail.com
I build detections, break into things on purpose to understand how they get missed, and document the investigation end-to-end — telemetry → detection logic → triage → verdict → MITRE mapping → response.
Blue team is the target role. Offensive work (below) exists to make the detections better, not as a separate track.
| Project | What it shows |
|---|---|
| kcd-web-rdp-compromise-investigation | Full incident investigation: password spraying → valid account abuse → malicious binary execution, via Splunk log analysis |
| aws-detection-pipeline | Live, automated detection: CloudTrail → EventBridge → Lambda → DynamoDB, with SNS alerting and optional auto-containment for IAM role assumption abuse |
| clouthaus-social-engineering-investigation | Multi-stage KQL investigation: phishing → credential harvest → account takeover → mailbox exfiltration → OSINT pivot |
| VulnHub-DC1-Writeup | Offensive side: CVE-2018-7600 (Drupalgeddon2) RCE → credential extraction → SUID privilege escalation to root |
| Project | Attack surface | Tools |
|---|---|---|
| KCD-Web-Threat-Hunt | Multi-stage dropper chain + C2 beaconing | Splunk, Sysmon |
| kcd-web-rdp-compromise-investigation | RDP compromise, password spraying | Splunk |
| network-analysis-webshell | Web shell: port scan → dir brute-force → SQLi → file upload → reverse shell | Wireshark |
| soc-phishing-email-analysis | Header forensics, SPF/DKIM/DMARC, IOC enrichment | AbuseIPDB, VirusTotal |
| clouthaus-social-engineering-investigation | Phishing → ATO → exfiltration → OSINT | KQL (KC7) |
| kc7-valdoria-investigation | Phishing → PowerShell persistence → SSH tunneling → exfiltration | KQL (KC7) |
| brute-force-detection-brutus | SSH brute-force, timeline reconstruction — no SIEM, raw log parsing | auth.log, wtmp |
| Project | Detects | Stack |
|---|---|---|
| aws-detection-pipeline | IAM role assumption abuse (live pipeline) | CloudTrail, EventBridge, Lambda, DynamoDB, SNS |
| aws-cloudtrail-sigma-lab | IAM abuse, EC2 injection, S3 enumeration | Athena, Sigma |
| Project | Technique |
|---|---|
| VulnHub-DC1-Writeup | Drupalgeddon2 RCE, credential extraction, SUID escalation |
| Project | Note |
|---|---|
| intrusion_detection_system | Real-time ML-based IDS — LightGBM on flow-level features, live capture via TShark, Flask/SocketIO dashboard |
| AI-in-soc-investigation | Comparing general vs. role-based AI prompting for log triage across IDS/SIEM/firewall sources |
Splunk Wazuh Microsoft Sentinel / KQL Sigma Wireshark MITRE ATT&CK AWS (CloudTrail, EventBridge, Lambda, Athena) Python PowerShell Linux
Freelance web development on the side — portfolio-prapul and client demo sites. Kept separate from the security work above.