MANICHAND GUPTA

ECLIPSE MANIC · SECURITY PORTFOLIO

THE SECURITY SERIES

SOC OPERATIONS · DFIR · THREAT DETECTION

Skip to content

OPEN TO SOC / DFIR INTERNSHIPS · KC7 WORLD #836 OF 174,154

Manichand Gupta

Security Analyst

Entry-level Security Analyst investigating threats through a self-built SOC lab — SIEM alert triage, malware and phishing analysis, mapped to MITRE ATT&CK.

analyst@meerut:~
SCROLL

SECTION 02 / ABOUT

Analyst behind the glass

Entry-level Security Analyst based in Meerut, UP, currently pursuing a BCA in Cloud & Cybersecurity (2024–2027) at IIMT University. Builds and runs a self-managed SOC lab for hands-on detection and monitoring practice, and develops independent security tools for malware and phishing analysis. Comfortable across SIEM, IDS/IPS, endpoint monitoring, network analysis, and DFIR tooling.

Color shifts by section, mapped to Defense-in-Depth layers — perimeter to data.

KC7
Under 0.5%
World #836 of 174,154 players
Global rank #836 of 174,154 players on the KC7 profile ↗
Verify proof ↗
SOC Operations
0
Alerts → 3 Cases
9,567 raw alerts reduced to 46 actionable alerts and three closed cases across a 20-stage campaign
Threat Intelligence
0
YARA Signatures
Aggregated across 40+ threat intel feeds and source repositories
CyberDefenders
India #229
World #4,017
India #229 / World #4,017 on the CyberDefenders profile ↗
Verify proof ↗
Research
0
Write-ups Published
Published DFIR investigation write-ups with IOCs mapped to ATT&CK

SECTION 02A / DEFENSE IN DEPTH

Layers I work in

The tools behind each layer are listed in the toolkit and mapped in MITRE ATT&CK coverage.

Network layer

SIEM correlation, traffic inspection, and protocol-level threat detection

Wazuh Microsoft Sentinel Splunk Elastic Stack Wireshark tcpdump Nmap

Click any ring · Tab + Enter works too.

PERIMETER NETWORK ENDPOINT APP DATA

SECTION 03 / EXPERIENCE

Hands on the queue

This is the analyst workflow inside the same seven-node lab documented in the SOC lab environment.

Self-Built SOC Detection & Monitoring Lab

Independent

JUL 2026 — OCT 2026
  • Monitored Wazuh and Suricata alerts across a seven-node hybrid lab spanning VMware and Azure
  • Triaged a 9,567-alert feed down to 46 alerts across three incident cases using 148 rules and 87 suppressions
  • Contained a live intrusion — severed reverse shells, quarantined webshells, and invalidated forged Kerberos tickets via a double krbtgt reset
  • Documented IOCs, root causes, containment, and ATT&CK mappings for each case, then hardened the root-cause flaws
Wazuh Suricata Sysmon TheHive Velociraptor MITRE ATT&CK

SECTION 03A / SOC LAB ENVIRONMENT

The environment I built

Seven nodes across VMware and Azure: a dual-homed Suricata gateway, an Active Directory victim network, and cloud-hosted Wazuh, TheHive, and Velociraptor — joined by a Zero-NAT WireGuard tunnel.

See how its 46 alerts were triaged into three cases in Hands on the queue.

WireGuard · UDP 51820 AZURE VNET · 10.122.0.0/16 ATTACK SEGMENT VICTIM NETWORK · 192.168.56.0/24 CASE MGMT · DFIR TheHive + Velociraptor SIEM · INDEXER Wazuh (Azure) · 4.14.8 ATTACKER Kali NIDS · ROUTER · VPN Suricata Gateway 8.0.6 DC · AD DS · SYS Win Server 2022 192.168.56.10 WIN 10 · SYSMON Workstation 192.168.56.20 WEB · AUDITD DVWA · Ubuntu 192.168.56.30

Wazuh SIEM (Azure)

Manager · Indexer · Dashboard 4.14.8

Central log aggregation, correlation, and alert triage. Applies 148 custom detection rules and 87 false-positive suppressions to Sysmon, Auditd, and Suricata events, then forwards Level ≥ 8 alerts to TheHive.

148 Rules87 SuppressionsCorrelation

7

Nodes

148

Detection rules

46

Alerts / 3 cases

DETECTION ENGINEERING

Four layers that cover each other

No single sensor sees everything. Each layer carries a blind spot the next one closes — the wire, the Linux kernel, the Windows endpoint, and central correlation.

L1 · WIRE

Suricata NIDS

AF-PACKET on the dual-homed gateway (8.0.6)

Sniffs raw packets between the attack segment and the victim subnet: Nmap sweeps, SQLi in HTTP URIs, and Kerberos TGS-REQs that never reach a host logger.

Blind spot — cannot read encrypted HTTPS/SSH, or commands typed on a host.

L2 · KERNEL

Auditd + bashcmd

execve syscalls + Rule 100220

Hooks the Linux netlink layer for every process run by www-data, and logs interactive command lines — pipes, built-ins, and compound chains — from the shell.

Blind spot — Linux only; no wire packets, no Windows members.

L3 · ENDPOINT

Sysmon + Security logs

EID 1 process · EID 3 network · 4624 / 4720 / 4728

Deep endpoint forensics on the DC and Win10: full command lines, sockets, and registry tampering, plus who logged in and who gained privilege.

Blind spot — Windows only; blind to the wire and to Linux.

L4 · CORRELATION

Wazuh SIEM

148 rules · 87 suppressions · CDB lookups

Decodes all four agent streams, matches 1,300+ lines of local rules, silences OS noise with CDB lists, and fires Level ≥ 8 alerts to the incident desk.

Blind spot — only sees what the agents and decoders forward.

The four pillars — the full lifecycle the lab is built around.
Lab-to-detection map — every host and the sensors watching it.

SOAR PIPELINE

A custom Python daemon replaced Shuffle

Under aggressive attack, webhook-based Shuffle collapsed: 400 webhooks in 10 s overflowed its listeners, forked scripts blocked on HTTP, and wazuh-analysisd lagged and dropped alerts.

I replaced it with a two-tier pipeline. Tier 1 writes each Level ≥ 8 alert straight into a local SQLite database in WAL mode — no network call, committing in under 0.2 ms, so the SIEM engine never blocks. Tier 2 is a systemd daemon that wakes every 5 s, fingerprints the tool (Nmap, Nikto, Hydra, sqlmap), groups related bursts, and pushes clean batches to TheHive.

Generation-counter optimistic concurrency marks a group dirty if new alerts land mid-flight, so nothing is lost between ticks.

< 0.2 msSQLite WAL commit
5 sdaemon flush cadence
4.6 smedian end-to-end (min 1.4 s)
0alerts dropped in bursts
18.9 ms500-alert ingest · p95 23.0 ms
17 / 17self-tests passing
Telemetry pathway — how the wire and host sensors reach the cloud SIEM without NAT.

DETECTION SCORECARD

An honest 14 / 2 / 2 / 2

100% detection is a lab myth. The campaign was measured honestly: what was caught directly, what was caught only on the pivot, and what could not be caught at all.

14Direct target & wire70.0% · Stages 01–03, 05–08, 10, 13, 15, 17–20
2Pivot-only alerts10.0% · DG-14 DCSync, DG-16 Golden Ticket
2Target logging gaps10.0% · DG-09 L2 drops, DG-12 LDAP EID 1644
2Inherent offline gaps10.0% · DG-04 / DG-11 GPU cracking
16 / 20Operational coverage · 80% · 0 engine failuresEvery rule and decoder ran clean — no silent drop

9,567 raw events → 808 curated (11 filters) → 46 TheHive alerts → 3 closed cases

Why the gaps existed — the seven architectural flaws behind the 14 / 2 / 2 / 2 score.

THE CAMPAIGN

74 minutes, 20 stages, three cases

A controlled intrusion from external port scan to full Active Directory takeover, mapped to 20 MITRE ATT&CK techniques across 9 tactics — then triaged into three TheHive cases, all resolved and closed.

CAS-001-WEBCOMPStages 01–07

Perimeter web compromise & local escalation

Nmap reconnaissance, credential brute force, SQL injection dumping the user table, a PHP web shell, a Netcat reverse shell, a sudo-python root escape, and rogue SSH key persistence.

Resolved · Closed

CAS-002-LATMOVEStages 08–14

Pivot, credential access & AD escalation

Internal subnet sweep, Responder LLMNR/NBT-NS poisoning, offline NTLMv2 cracking, BloodHound LDAP recon, Kerberoasting HANK_SHERMAN, and DCSync replication of the NTDS database.

Resolved · Closed

CAS-003-DOMIMPStages 15–20

Domain takeover, lateral movement & impact

Pass-the-Hash via WMI, a forged Kerberos Golden Ticket, a rogue Domain Admin, document collection, SCP exfiltration, wallpaper defacement and simulated ransomware plus forced reboot.

Resolved · Closed

20-stage roadmap — every technique in execution order.
Five acts — the campaign condensed into its five phases.
74-minute timeline — attack vs. detection, minute by minute.

RESPONSE

Contained first, then fixed at the root

7 containment actions

  1. Firewall-dropped the attacker origin on INPUT and FORWARD at the gateway
  2. Killed the reverse shell and quarantined shell.php
  3. Purged the rogue root SSH key and severed the TTY sessions
  4. Disabled the backdoor account and stripped it from Domain Admins
  5. Double-reset krbtgt to KVNO 3, invalidating forged tickets
  6. Quarantined staged files and restored the tampered wallpaper
  7. Rotated the DVWA, MariaDB, and web-app credentials

7 root causes erased

  1. Sudoers NOPASSWD python3 path removed
  2. PermitRootLogin no + PasswordAuthentication no
  3. Uploads directory denied script execution
  4. Service account demoted, SPN deleted, AES Kerberos enforced
  5. Privileged accounts moved into Protected Users
  6. LLMNR and NetBIOS-over-TCP/IP disabled fleet-wide
  7. Flat DMZ routing replaced with iptables micro-segmentation
Containment playbook — the lockdown sequence, in order.
Hardening roadmap — the permanent fixes that remove the root causes.

EVIDENCE

The IOC register

Every observable verified against live telemetry and catalogued into six categories for the final report.

  • NetworkAttacker, pivot, and victim IPs; C2 4444; admin 22; SMB 445; RPC 135; Kerberos 88; LDAP 389; LLMNR/NetBIOS
  • Host & filesystemWeb shell, FIFO pipe, staged hash dumps, hacked.bmp, ransom note, dummy .enc files
  • RegistryWallpaper / WallpaperStyle tampering on the DC and workstation
  • Identityadmin, dvwa, www-data, root, win10, HANK_SHERMAN, Administrator, backdoor, krbtgt
  • Hashes & secretsMD5, NetNTLMv2, Kerberoast TGS, krbtgt NTLM, a Golden Ticket, an injected ED25519 key
  • Tooling & commandsNmap, sqlmap, Netcat, Responder, Impacket (SPNs, secretsdump, wmiexec, ticketer), Hashcat, reg.exe
Investigation lifecycle — how the observables became three closed cases.
NIST SP 800-61 — the response mapped to the formal IR lifecycle.

Every diagram is drawn from the lab's own artifacts and sits with the section it explains. Read the full write-up at soc-lab.eclipsemanic.me · inspect the source at github.com/EclipseManic/SOC-Lab.

SECTION 04 / SKILLS & TOOLS

The toolkit

Depth Pro Working Learning Hover a tool for how it is used.

59 tools across 12 categories. The full inventory, with context, is in the resume.

SECTION 05 / MITRE ATT&CK

Mapped to the matrix

Detection coverage mapped across 14 MITRE ATT&CK tactics from lab telemetry and published investigations.

Detection coverage across 14 MITRE ATT&CK tactics, full kill-chain — open on desktop for the interactive matrix.

SECTION 06 / ORIGINALS

Security Originals

Five tools and investigation projects. Open any title for its full case file, methods, evidence, and technical details.

PROJECT 01 / 05
MALWARE TRIAGE

Malware
Analyzer

Malware triage tool scanning PE, ELF, Mach-O, APK, Office, PDF, scripts, and archives via a Flask/WebSocket dashboard. 2,778 YARA rules from 40 sources. Connects VirusTotal, Hybrid Analysis, Tria.ge, and FileScan.io with live scan progress. Drop a file — or a whole folder — and the queue triages everything in one pass, streaming verdicts to the browser as each engine reports back. Verdicts arrive with matched rules and engine reports side by side, so one screen answers the first triage question. Every scan leaves a shareable record you can revisit later.

Challenge: Manual triage across many file formats is slow — analysts jump between separate tools for each type.
  • Multi-format static analysis: PE, ELF, Mach-O, APK, Office, PDF, scripts, archives
  • 2,778 YARA rules aggregated from 40 intel sources
  • Live WebSocket scan queue with per-file verdicts
  • Multi-engine reputation lookup: VirusTotal, Hybrid Analysis, Tria.ge, FileScan.io
YARA Flask WebSocket VirusTotal
GitHub ↗
PROJECT 02 / 05
T1566 PHISHING

Phishing Mail
Detector

11-step Flask tool validating SPF, DKIM, DMARC, and ARC to catch spoofed emails. Brand-check system covering ~50 commonly faked brands plus QR-code (quishing) detection. ~40-signal risk-scoring model mapped to MITRE ATT&CK T1566. Paste any raw email or .eml and get a full header breakdown, an impersonation verdict, and plain-English reasoning for every signal — evidence an analyst can act on, not a black-box score. Results are structured for handoff — each failed check links straight to the header evidence behind it.

Challenge: Spoofed and brand-impersonating emails pass casual inspection; authentication results are buried in headers most users never read.
  • 11-step header validation: SPF, DKIM, DMARC, ARC chain
  • Impersonation checks against ~50 commonly faked brands
  • QR-code (quishing) detection inside message bodies
  • ~40-signal scoring model mapped to MITRE ATT&CK T1566
SPF/DKIM/DMARC T1566 Flask QR Detection
GitHub ↗
PROJECT 03 / 05
EVTX FORENSICS

Event Analyzer
Web

Fast, analyst-first Windows EVTX viewer with built-in IOC extraction, Sigma rule matching, and MITRE ATT&CK mapping. Upload one or many .evtx files, filter by event ID/channel/provider, bookmark events, take notes, and export results. Drag in a full event dump and pivot instantly — jump to matched Sigma hits, correlate extracted IOCs, and build the case notes as you go. One search box covers events, IOCs, and notes, so the pivot from timeline to evidence stays under a minute. Results export cleanly for case notes and reports.

Challenge: Windows EVTX files are cumbersome to parse manually; analysts need a fast viewer with built-in intel enrichment in one interface.
  • Parallel multi-file .evtx ingestion and indexing
  • IOC extraction with hash, domain, and IP correlation
  • Sigma rule matching with MITRE ATT&CK technique mapping
  • Bookmarks, analyst notes, and exportable case output
EVTX Parsing Sigma Rules IOC Extraction Vue 3
GitHub ↗
PROJECT 04 / 05
DFIR REPORTS

Investigation
Portfolio

Real phishing, malware, and network attack investigations with detailed reports — IOC extraction and MITRE ATT&CK mapping. Full case log in Field Reports below. Seven published write-ups so far. Each report follows the same SOC cadence — scope, timeline, evidence, IoCs, detection gaps, and recommendations — so every conclusion is reviewable end to end. The library keeps growing as each new lab case gets written up in the same format. Every report is written to be reviewed end to end, with the full artifact trail attached.

Challenge: Lab skills are invisible without documented, reviewable investigations written the way a real SOC writes them.
  • Seven published investigation write-ups and counting
  • IOC extraction with hash, domain, and IP correlation
  • MITRE ATT&CK technique mapping per case
  • Detection-gap analysis and remediation guidance
IOC Extraction ATT&CK Mapping Wazuh Suricata
GitHub ↗
PROJECT 05 / 05
THREAT INTELLIGENCE

Threat
Sentry

Real-time threat intelligence aggregator pulling from multiple open-source feeds — URLhaus, ThreatFox, AlienVault OTX, and AbuseIPDB. Correlates indicators, surfaces attacker infrastructure, and maps IoCs to MITRE ATT&CK techniques. Indicators are normalized, deduplicated, and confidence-scored, so campaign infrastructure stands out from feed noise instead of drowning in it. Related indicators are grouped into campaigns, turning the raw feed into attacker storylines. The dashboard surfaces the infrastructure behind each campaign.

Challenge: Threat intel feeds generate massive noise. Analysts need correlation, dedup, and ATT&CK mapping — not a raw feed reader.
  • Live ingestion from URLhaus, ThreatFox, OTX, and AbuseIPDB
  • Cross-feed normalization and deduplication
  • Confidence scoring with attacker-infrastructure grouping
  • MITRE ATT&CK technique mapping on correlated indicators
Threat Intelligence IOC Correlation ATT&CK Mapping Flask
GitHub ↗
01 / 05 PROJECTS

SECTION 07 / FIELD REPORTS

Case files

Real investigations and CTF walkthroughs — from phishing campaigns to RAT analysis, documented step by step.

CASE-2026-001

Job Phishing Campaign — Impersonating Naukri.com

Social engineering · Advance-fee job scam

Read report →
CASE-2026-002

Storm-2949: How One Cloud Account Led to a Full Enterprise Breach

Cloud compromise

Read report →
CASE-2026-003

AI Helpdesk Compromise Leading to Workstation Breach (HackTheBox)

Artifact triage

Read report →
CASE-2026-004

Yellow Cockatoo RAT “Jupyter’s Bro” (CyberDefenders)

RAT analysis

Read report →
CASE-2026-005

PoisonedCredentials (CyberDefenders)

LLMNR/NBT-NS poisoning · NTLMv2 credential capture

Read report →
CASE-2026-006

Stealc Infostealer (Oski Lab) (CyberDefenders)

Sandbox/C2 analysis

Read report →
CASE-2026-007

WebStrike (CyberDefenders)

Web attack investigation

Read report →
All write-ups on Medium

SECTION 07A / LIVE ACTIVITY

Pulled live

Fetched client-side from the GitHub API and Medium RSS at page load — not hand-written cards. If a network fetch fails, the block below says so instead of faking it.

GitHub — recent activity

FETCHING github.com/EclipseManic …

Medium — latest write-ups

FETCHING eclipsemanic.medium.com …

SECTION 08 / TOP PICKS

Manichand Gupta’s Top Picks

Professional certifications selected from the resume. Scroll the posters to explore each credential, then open its verification link.

THE COMPLETE PROFILE · RESUME

The complete profile

Education · practice · projects · skills
MANICHAND GUPTAMEERUT, UP · OPEN TO RELOCATION

Professional Summary

Security analyst covering the full defense workflow — detection engineering, alert triage, endpoint investigation, and incident reporting. Built and operated a seven-node hybrid-cloud SOC lab (Wazuh, Suricata, Sysmon, Auditd, TheHive, Velociraptor) across VMware and Azure, where a 20-stage, 74-minute attack campaign was caught by 148 custom Wazuh rules and 11 Suricata signatures — 16 of 20 stages detected — and 9,567 raw events were compressed into 46 alerts and three closed cases. Independently investigates fraud and malware campaigns and builds open-source DFIR tools. Ranked World #4,017 / India #229 on CyberDefenders and World #836 of 174,154 (under 0.5%) on KC7.

Relevant Experience

Personal SOC & Incident Response LabSelf-directed security operations practice
  • Built a seven-node hybrid SOC across VMware Workstation and Microsoft Azure, joining a dual-homed Suricata gateway and an isolated Active Directory victim subnet to cloud Wazuh, TheHive, and Velociraptor over a Zero-NAT WireGuard tunnel.
  • Authored 148 custom Wazuh detection rules and 87 false-positive suppressions; built a Python SOAR bridge (SQLite WAL buffer) that reduced 9,567 raw alerts to 46 actionable alerts and three closed cases.
  • Ran a 20-stage, 74-minute red-team campaign and executed containment: severed reverse shells, quarantined webshells, revoked SSH keys, and invalidated forged Kerberos tickets via a double krbtgt reset (KVNO 3).
  • Investigated hosts with Velociraptor; recorded evidence, indicators, response actions, and MITRE ATT&CK mappings in TheHive 5.7.5.

Selected Projects

Malware Analyzer – Web ↗Scans PE, ELF, Mach-O, APK, Office, PDF, scripts, and archives; 2,778 YARA rules from 40 sources; VirusTotal, Hybrid Analysis, Tria.ge, and FileScan.io; 75 automated tests.
Phishing Mail Detector ↗SPF, DKIM, DMARC, and ARC checks; about 50 impersonated brands; QR scam detection; roughly 40 risk signals; VirusTotal and urlscan.io lookups; ATT&CK T1566.
Investigation Portfolio ↗Seven cases, including a live internship-fraud campaign analyzed through company and domain research plus PDF malware reverse engineering, and a multi-vector job scam; five additional CyberDefenders and HackTheBox reports.
ThreatSentry AI ↗PyQt5 threat-hunting dashboard featured on Kitploit: Shodan asset discovery, NVD CVE correlation across 14+ product types, and an ensemble risk model with scheduled retraining.

Education

Bachelor of Computer Application – Cloud & CybersecurityIIMT University, Meerut · 7.5 CGPA through 4th semester

Open to SOC / DFIR internships

Manichand Gupta

Security Analyst

I investigate what others miss — every alert triaged, every log correlated, every threat mapped to how it actually happened.

World #836Verify ↗KC7KC7 · of 174,154 players
SOC Operations46Alerts → 3 cases
CyberDefenders#4,017World rank · India #229
Threat Intel2,778YARA rules
ATT&CK20Attack stages
Research7Write-ups published

01 — Background

Analyst behind the glass

Entry-level Security Analyst based in Meerut, UP, pursuing a BCA in Cloud & Cybersecurity (2024–2027) at IIMT University. Comfortable across SIEM, IDS/IPS, endpoint monitoring, network analysis and DFIR tooling.

Jul 2026 — Oct 2026

Self-Built SOC Detection & Monitoring Lab

Independent

  • Monitored Wazuh and Suricata alerts across a seven-node hybrid lab spanning VMware and Azure
  • Triaged a 9,567-alert feed down to 46 alerts across three incident cases using 148 rules
  • Contained a live intrusion — severed reverse shells, quarantined webshells, reset krbtgt
  • Documented IOCs, root causes and ATT&CK mappings, then hardened the root-cause flaws

Education

BCA — Cloud & Cybersecurity IIMT University, Meerut 2024 — 2027 · in progress

02 — Inside the lab

The home lab I worked on

A seven-node hybrid SOC lab — Azure-hosted Wazuh, TheHive and Velociraptor joined to a VMware victim network by a Zero-NAT WireGuard tunnel — built to run an attack, catch it, and investigate it end to end.

THE ENVIRONMENT

Four pillars, mapped to the sensors

The four pillars — the full lifecycle the lab is built around.
Lab-to-detection map — every host and the sensors watching it.

DETECTION SCORECARD

An honest 14 / 2 / 2 / 2

14Direct target & wire70.0%
2Pivot-only10.0%
2Logging gaps10.0%
2Offline gaps10.0%
16 / 20Operational coverage · 80%0 engine failures

9,567 raw → 46 alerts → 3 cases

Why the gaps existed — the seven architectural flaws behind the score.

SOAR PIPELINE

Custom Python SQLite-WAL daemon

A two-tier pipeline replaced Shuffle: < 0.2 ms local WAL commits, a 5 s flush daemon, and 4.6 s median end-to-end with zero dropped alerts.

< 0.2 msWAL commit
5 sflush cadence
4.6 smedian E2E
0alerts dropped
18.9 msingest avg
17 / 17self-tests
Telemetry pathway — how the sensors reach the cloud SIEM.

THE CAMPAIGN

74 min · 20 stages · 3 cases

CAS-001-WEBCOMP01–07

Perimeter web compromise & local escalation

Nmap recon, brute force, SQL injection, PHP web shell, Netcat reverse shell, sudo-python root escape, SSH key persistence.

Resolved · Closed

CAS-002-LATMOVE08–14

Pivot, credential access & AD escalation

Internal sweep, Responder poisoning, NTLMv2 cracking, BloodHound recon, Kerberoasting, DCSync replication.

Resolved · Closed

CAS-003-DOMIMP15–20

Domain takeover, lateral movement & impact

Pass-the-Hash, forged Golden Ticket, rogue Domain Admin, SCP exfiltration, defacement and simulated ransomware.

Resolved · Closed

20-stage roadmap — every technique in order.
Five acts — the campaign in five phases.
74-minute timeline — attack vs. detection.

RESPONSE

Contained, then fixed at the root

7 containment actions

  1. Dropped the attacker origin at the gateway firewall
  2. Killed the reverse shell, quarantined shell.php
  3. Purged the rogue root SSH key and sessions
  4. Disabled backdoor, stripped Domain Admins
  5. Double-reset krbtgt to KVNO 3
  6. Quarantined staged files, restored wallpaper
  7. Rotated DVWA / MariaDB / app credentials

7 root causes erased

  1. Sudoers NOPASSWD python3 removed
  2. Root SSH login and password auth disabled
  3. Uploads directory script execution denied
  4. Service account demoted, SPN deleted, AES enforced
  5. Privileged accounts in Protected Users
  6. LLMNR and NetBIOS disabled fleet-wide
  7. DMZ micro-segmented with iptables
Containment playbook — the seven actions in order.
Hardening roadmap — the permanent root-cause fixes.

EVIDENCE

The IOC register

  • NetworkAttacker/pivot/victim IPs; C2 4444; SMB 445; Kerberos 88; LDAP 389; LLMNR/NetBIOS
  • HostWeb shell, FIFO pipe, hash dumps, hacked.bmp, ransom note, dummy .enc files
  • RegistryWallpaper tampering on the DC and workstation
  • Identityadmin, dvwa, www-data, root, win10, HANK_SHERMAN, Administrator, backdoor, krbtgt
  • HashesMD5, NetNTLMv2, Kerberoast TGS, krbtgt NTLM, a Golden Ticket, an ED25519 key
  • ToolingNmap, sqlmap, Netcat, Responder, Impacket, Hashcat, reg.exe
Investigation lifecycle — how the observables became closed cases.
NIST SP 800-61 — the response on the formal IR lifecycle.

Every diagram is drawn from the lab's own artifacts and sits with the section it explains. Full write-up at soc-lab.eclipsemanic.me.

03 — Selected work

Projects I Built

04 — Credentials

Certifications

05 — Field reports

Case files

  1. CASE-2026-001 Job Phishing Campaign — Impersonating Naukri.com Social engineeringAdvance-fee job scam
  2. CASE-2026-002 Storm-2949: How One Cloud Account Led to a Full Enterprise Breach Cloud compromise
  3. CASE-2026-003 AI Helpdesk Compromise Leading to Workstation Breach Artifact triageHackTheBox
  4. CASE-2026-004 Yellow Cockatoo RAT “Jupyter’s Bro” RAT analysisCyberDefenders
  5. CASE-2026-005 PoisonedCredentials LLMNR/NBT-NS poisoningCyberDefenders
  6. CASE-2026-006 Stealc Infostealer — Oski Lab Sandbox / C2 analysisCyberDefenders
  7. CASE-2026-007 WebStrike Web attack investigationCyberDefenders
All write-ups on Medium ↗

06 — Contact

Let’s investigate together

Open to SOC / DFIR internships and junior analyst roles. If you have alerts, I have eyes.

manichand.gupta.contact@gmail.com

Meerut, UP · © 2026 Manichand Gupta