Skip to content
View rootverdict's full-sized avatar
  • Gandhinagar, India
  • 21:12 (UTC +05:30)

Block or report rootverdict

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
rootverdict/README.md

Aryan Hirapara

M.Sc. Digital Forensics & Information Security - National Forensic Sciences University Blue-team & detection engineering · network forensics · detection-as-code

I build evidence-backed security tooling and contribute fixes to open-source blue-team platforms. Every project below ships with tests, CI, and reproducible evidence artifacts.

Projects

Project What it does Stack
detfuzz Evidence-backed detection-resilience testing for PowerShell/Sigma rules - safe mutations correlated against Sysmon telemetry, 98 unit tests, signed release Python · pySigma · Sysmon
NetTrace Offline malware-traffic analysis - PCAP parsing, beaconing/DGA detection, MITRE ATT&CK mapping, PDF reports. Validated on 12 real malware captures Python · Scapy
soc-automation-lab End-to-end SOC pipeline: Wazuh detection → n8n SOAR triage → VirusTotal → Velociraptor forensics, with an 18-case analyst casebook Wazuh · n8n · Velociraptor
MalForge Sandbox-report → detection-rule pipeline: Cuckoo/CAPE JSON → Sigma → Wazuh, with stable rule IDs and risk scoring Python · Sigma
signalbudget Cost-aware telemetry planning - Pareto frontier over ingest cost vs. hash-verified detection coverage Python (zero-dep)
vigilant-api Black-box API security scanner - OpenAPI-driven BOLA/IDOR/SSRF/JWT testing with forensic evidence output Python · OpenAPI

Open-source contributions

  • Panther - fixed a Kubernetes IOC detection query (Snowflake clause ordering) · merged
  • Wazuh - corrected RestrictAnonymous registry checks in Windows CIS policies
  • IntelMQ - CSV formula-injection fix in spreadsheet exports
  • IRIS · TheHive4py - session-handling fix / API documentation

Pinned Loading

  1. vigilant-api vigilant-api Public

    Black-box API security scanner - reads OpenAPI 3.x specs and tests live REST APIs for BOLA/IDOR, SSRF, OAuth, and JWT flaws.

    Python

  2. soc-automation-lab soc-automation-lab Public

    End-to-end SOC automation lab: Wazuh detection engineering (12 MITRE-mapped rules + 11 Sigma), n8n SOAR triage with VirusTotal enrichment, gated auto-containment, Velociraptor DFIR validation, and …

    Python

  3. detfuzz detfuzz Public

    Evidence-backed detection resilience testing for PowerShell and Sigma rules using safe mutations, Sysmon telemetry, deterministic classification, and reproducible reports.

    Python

  4. signalbudget signalbudget Public

    Cost-aware security telemetry planning. Builds a Pareto frontier over monthly ingest cost, hash-verified detection coverage, and investigation utility for three Windows log sources. Zero runtime deps.

    Python

  5. NetTrace NetTrace Public

    Offline malware traffic analysis platform in Python. Parses PCAPs, extracts DNS/HTTP/TLS artifacts and IOCs, detects beaconing and DGA domains, maps MITRE ATT&CK, and exports JSON/HTML/PDF reports.

    Python

  6. MalForge MalForge Public

    Local sandbox-report to detection-rule pipeline in Python. Parses Cuckoo, CAPE, and ANY.RUN JSON, extracts behaviors and IOCs, maps MITRE ATT&CK, generates Sigma rules, converts them to Wazuh XML w…

    Python