Manish Rawat
Security Analyst | Threat Detection & SIEM
Working through the MITRE ATT&CK Evaluations APT29 dataset in Splunk and documenting everything I find. Part 1 covers EventID 1, the initial dropper, steganographic payload execution inside a PNG image, and what the EventID distribution revealed about how APT29 avoids...
Just uploaded the 2nd Part of DLL Hijacking on #Substack
Where I analyzed real malware logs and discovered why non-admin users can execute code without triggering a single alert.
Link:
Recently something interesting happened.
My research on DLL hijacking detection was referenced in work from the National Cyber Security Centre (Cyber Defence Analysis).
The section “37 Sysmon Events. One Complete DLL Hijacking Attack” came from my analysis of malware telemetry...
New here, don't really know what I'm doing yet 👋
SOC Analyst. Build security automation stuff. Recently automated a full detection pipeline and wrote some Sigma rules.
Work with Wazuh, Splunk, Python, all the usual suspects.
Looking for security projects - automations, SIEM work,...
medium.com
Manish Rawat – Medium
Read writing from Manish Rawat on Medium. From Political Science to SOC Analyst | Writing about cybersecurity, detection engineering, and the self-taught journey
A Senior Challenged Me: "Build an Automated SOC Demo"
So I did.
What I built: Fully automated incident detection & response pipeline using Wazuh, N8N, Caldera, and Velociraptor.
The flow: Attack simulation → Detection → Auto-enrichment with VirusTotal → Jira ticket creation → Email...
medium.com
A Senior Challenged Me to Build an Automated SOC Demo. Here’s What I Built.
A few weeks back, a senior analyst gave me a challenge: “Build me a demo with Wazuh, N8N, Caldera, and Velociraptor. I want to see…