Manish Rawat
SOC Analyst | Detection Engineer | Threat Hunter
Summary
Work
Projects
Writing
PowerShell Encoded Commands: Building Detection Rules That Actually Work (Part 2)
February 1, 2026Lab-driven analysis of Splunk queries to detect encoded PowerShell variants (including -eNcO), explanation of indexing/tokenization pitfalls, regex-based detections, and practical query examples.
WMI Event Consumer Persistence: How APT29 Achieves Fileless Persistence (Part 1)
February 1, 2026Explains WMI persistence components (Event Filter, Event Consumer, Binding), why adversaries use WMI for stealthy persistence, and questions about detection/attribution in logs.
How I Built a Sigma Detection Rule to Catch APT29’s Encoded PowerShell Attacks
July 1, 2025Deep dive into threat-hunting methodology and a layered Sigma detection rule targeting encoded PowerShell (T1059.001), including parameter detection, process ancestry, network correlation, and deployment/tuning guidance.
Logs, Sweat, and Suricata: My Journey to a Real-Time Threat Hunting Powerhouse
May 1, 2025Practical walkthrough of integrating Suricata IDS with the ELK Stack, setup steps, common errors and fixes, and lessons on tuning and building a real-time network detection pipeline.
How I Analyzed My First Security Incident in a SOC
March 1, 2025A first-hand incident analysis describing triage of suspicious login attempts using SIEM, correlation, threat intelligence, escalation, and remediation steps with practical lessons for beginners.