_{👋 Good morning!  ·} 

Senior SOC Analyst (L3) with 5+ years across enterprise and MSSP environments. I'm the escalation point teams reach when the alert is real, the clock is loud, and the next call decides whether containment beats compromise. I lead with risk and business impact, not severity scores — and I document every move so the next analyst, manager, or auditor can follow the trail.

Outside of work I build open-source SOC labs that mirror enterprise stacks, so analysts can train on Splunk / QRadar / Sentinel / CrowdStrike-class tooling without the licensing wall.

• 🔭 Building — AI-augmented SOC automation: LLM-assisted alert triage, autonomous detection pipelines, agentic IR playbooks (CrewAI + Ollama)
• 🌱 Learning — Sigma rule authoring at scale · adversary emulation with Caldera · detection-as-code with CI/CD validation
• 🧪 Writing — Open-source SOC labs others can clone in 15 min (see Featured Labs below)
• 🎤 Discussing — detection engineering, SOAR design, the false-positive economy in modern SOCs

SIEM tuning · MITRE ATT&CK mapping · incident response playbooks · SOC home labs · L1 → L3 career progression · interview prep for SOC roles · transitioning from MSSP to in-house SOC · open-source SOAR vs. commercial vendors

SIEM / XDR / EDR

DFIR & Threat Intel

Detection Engineering & Frameworks

Offensive Security & Pen-Testing

SOAR & Scripting

A SOC analyst is judged on the quality of detections they ship, not the tools they list. Two examples below.

Sigma rule — encoded PowerShell with obfuscation indicators

title: Suspicious Encoded PowerShell Execution
id: 7c1e9b34-2f4a-4e6d-9a1c-1d5b7c0a4e91
status: stable
description: Detects PowerShell launched with base64-encoded command lines, a common
  technique used by malware loaders and red teams to evade plaintext detection.
references:
  - https://attack.mitre.org/techniques/T1059/001/
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\powershell.exe'
  encoded:
    CommandLine|contains:
      - '-enc'
      - '-EncodedCommand'
      - 'FromBase64String'
  condition: selection and encoded
falsepositives:
  - Admin scripts that legitimately use encoded commands (rare; pin to known hashes).
level: high
tags:
  - attack.execution
  - attack.t1059.001

Splunk SPL — lateral movement via SMB admin shares

index=wineventlog EventCode=5140
  ShareName IN ("\\\\*\\ADMIN$", "\\\\*\\C$")
  AccessMask="0x1"
| stats dc(ComputerName) as host_count
        values(ComputerName) as hosts
        values(IpAddress) as src_ips
        count
  by Account_Name
| where host_count >= 5 AND count >= 10
| sort - host_count
| eval risk_score = host_count * 10 + (count / 5)

Triggers when one account touches ADMIN$ / C$ on 5+ distinct hosts within the search window — classic post-exploitation lateral movement (PsExec, Impacket, Cobalt Strike psexec_psh).

_{A curated cross-section of live detection rules from across my open-source labs — what each rule catches, why it matters, and a link to the YAML. Every row is auto-generated from the actual rule files; click any source link to read the full logic.}

_{Configured detection windows for frequency-based rules in my labs — i.e. how many events must occur in what time span before each rule fires. Parsed from each rule's num_events and timeframe YAML fields; the values here are the same ones the live rules use in production.}

_{Latency = the rule's own detection window (parsed from timeframe, queryFrequency, or type). Portfolio spread: 1–60 minutes worst-case. These are configured windows, not measured end-to-end times — click any source link to verify the raw values.}

_{Cert order: senior/specialty first, foundational at the end. Update if you hold different titles — e.g. CSAP, GSEC, OSCP, AZ-500, AWS Security.}

_{📡 Personal lab + blog covering SOC operations, detection engineering, threat hunting walkthroughs, and open-source security tooling. Screenshot refreshes automatically — click to visit.}

Auto-refreshed daily by GitHub Actions. CVE feed from NIST NVD; threat headlines from public security RSS sources.

userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to the existingUsernameCheck.php endpoint. Attackers can submit usernames and analyze response text for the 'taken' string to identify existing accounts in the system.…

Source: NIST NVD. Last check: 2026-05-30 11:18 UTC. Auto-refreshed daily by cve-of-the-week.yml.

Last refresh: 2026-05-31 10:54 UTC

The Hacker News

• PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation
• ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface
• Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit
• New Russia-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks

BleepingComputer

• Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks
• New CIFSwitch Linux flaw gives root on multiple distributions
• ChatGPT share links abused to host fake outage pages to deliver malware
• California AG sues 23andMe over 2023 breach exposing health data

Krebs on Security

• Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
• Lawmakers Demand Answers as CISA Tries to Contain Data Leak
• Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada
• CISA Admin Leaked AWS GovCloud Keys on Github

Headlines pulled from public RSS feeds. Not endorsements — just situational awareness.

I'm actively open to Senior SOC Analyst / L3 / Detection Engineer / Threat Hunter roles. Remote-friendly, UK/EU preferred but happy to talk about anywhere with reasonable time-zone overlap.

📧 Fastest way to reach me: sandeep.mothukuris@gmail.com 🔗 Or send a LinkedIn message: linkedin.com/in/sandeepmothukuri

📧 Fastest way to reach me: sandeep.mothukuris@gmail.com — typical reply within 24h.

_{⭐ If a lab or write-up helped you, a star helps other SOC analysts find this work.}

_{Released under the MIT License. © 2026 Sandeep Mothukuri.}