Writeups

This section showcases structured SOC-style investigations conducted using public threat datasets.
Each entry emphasizes packet-level validation, indicator extraction, and incident-focused reporting rather than step-by-step lab walkthroughs.

SOC Network Traffic Investigation

Structured malware PCAP investigation identifying infected host, confirming payload delivery, and validating encrypted follow-on communication.

Focus: Wireshark analysis, TLS inspection, IOC extraction, single-host impact validation

View Writeup
Incident Response – NetSupport RAT

PCAP-based incident investigation confirming command-and-control (C2) activity through DNS resolution, TLS SNI validation, HTTP POST beaconing, and TCP stream inspection.

Focus: IDS correlation, C2 validation, application-layer analysis, structured incident reporting

View Writeup

Investigation Structure

Each investigation follows a structured workflow aligned with SOC operations:

The objective is to demonstrate practical SOC investigative thinking aligned with real-world alert escalation and incident response processes.