_{👋 Good morning!  ·} 

Senior SOC Analyst (L3) with 5+ years across enterprise and MSSP environments. I'm the escalation point teams reach when the alert is real, the clock is loud, and the next call decides whether containment beats compromise. I lead with risk and business impact, not severity scores — and I document every move so the next analyst, manager, or auditor can follow the trail.

Outside of work I build open-source SOC labs that mirror enterprise stacks, so analysts can train on Splunk / QRadar / Sentinel / CrowdStrike-class tooling without the licensing wall.

• 🔭 Building — AI-augmented SOC automation: LLM-assisted alert triage, autonomous detection pipelines, agentic IR playbooks (CrewAI + Ollama)
• 🌱 Learning — Sigma rule authoring at scale · adversary emulation with Caldera · detection-as-code with CI/CD validation
• 🧪 Writing — Open-source SOC labs others can clone in 15 min (see Featured Labs below)
• 🎤 Discussing — detection engineering, SOAR design, the false-positive economy in modern SOCs

SIEM tuning · MITRE ATT&CK mapping · incident response playbooks · SOC home labs · L1 → L3 career progression · interview prep for SOC roles · transitioning from MSSP to in-house SOC · open-source SOAR vs. commercial vendors

SIEM / XDR / EDR

DFIR & Threat Intel

Detection Engineering & Frameworks

Offensive Security & Pen-Testing

SOAR & Scripting

A SOC analyst is judged on the quality of detections they ship, not the tools they list. Two examples below.

Sigma rule — encoded PowerShell with obfuscation indicators

title: Suspicious Encoded PowerShell Execution
id: 7c1e9b34-2f4a-4e6d-9a1c-1d5b7c0a4e91
status: stable
description: Detects PowerShell launched with base64-encoded command lines, a common
  technique used by malware loaders and red teams to evade plaintext detection.
references:
  - https://attack.mitre.org/techniques/T1059/001/
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\powershell.exe'
  encoded:
    CommandLine|contains:
      - '-enc'
      - '-EncodedCommand'
      - 'FromBase64String'
  condition: selection and encoded
falsepositives:
  - Admin scripts that legitimately use encoded commands (rare; pin to known hashes).
level: high
tags:
  - attack.execution
  - attack.t1059.001

Splunk SPL — lateral movement via SMB admin shares

index=wineventlog EventCode=5140
  ShareName IN ("\\\\*\\ADMIN$", "\\\\*\\C$")
  AccessMask="0x1"
| stats dc(ComputerName) as host_count
        values(ComputerName) as hosts
        values(IpAddress) as src_ips
        count
  by Account_Name
| where host_count >= 5 AND count >= 10
| sort - host_count
| eval risk_score = host_count * 10 + (count / 5)

Triggers when one account touches ADMIN$ / C$ on 5+ distinct hosts within the search window — classic post-exploitation lateral movement (PsExec, Impacket, Cobalt Strike psexec_psh).

_{A curated cross-section of live detection rules from across my open-source labs — what each rule catches, why it matters, and a link to the YAML. Every row is auto-generated from the actual rule files; click any source link to read the full logic.}

_{Configured detection windows for frequency-based rules in my labs — i.e. how many events must occur in what time span before each rule fires. Parsed from each rule's num_events and timeframe YAML fields; the values here are the same ones the live rules use in production.}

_{Latency = the rule's own detection window (parsed from timeframe, queryFrequency, or type). Portfolio spread: 1–60 minutes worst-case. These are configured windows, not measured end-to-end times — click any source link to verify the raw values.}

_{Cert order: senior/specialty first, foundational at the end. Update if you hold different titles — e.g. CSAP, GSEC, OSCP, AZ-500, AWS Security.}

_{📡 Personal lab + blog covering SOC operations, detection engineering, threat hunting walkthroughs, and open-source security tooling. Screenshot refreshes automatically — click to visit.}

Auto-refreshed daily by GitHub Actions. CVE feed from NIST NVD; threat headlines from public security RSS sources.

HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by…

Source: NIST NVD. Last check: 2026-05-25 13:28 UTC. Auto-refreshed daily by cve-of-the-week.yml.

Last refresh: 2026-05-25 12:25 UTC

The Hacker News

• Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks
• The Alert Firehose Finally Meets Its Match
• Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms
• TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO

BleepingComputer

• Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign
• Laravel Lang packages hijacked to deploy credential-stealing malware
• Italy disrupts CINEMAGOAL piracy app that stole streaming auth codes
• Netherlands seizes 800 servers of hosting firm enabling cyberattacks

Krebs on Security

• Lawmakers Demand Answers as CISA Tries to Contain Data Leak
• Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada
• CISA Admin Leaked AWS GovCloud Keys on Github
• Patch Tuesday, May 2026 Edition

Headlines pulled from public RSS feeds. Not endorsements — just situational awareness.

I'm actively open to Senior SOC Analyst / L3 / Detection Engineer / Threat Hunter roles. Remote-friendly, UK/EU preferred but happy to talk about anywhere with reasonable time-zone overlap.

📧 Fastest way to reach me: sandeep.mothukuris@gmail.com 🔗 Or send a LinkedIn message: linkedin.com/in/sandeepmothukuri

📧 Fastest way to reach me: sandeep.mothukuris@gmail.com — typical reply within 24h.

_{⭐ If a lab or write-up helped you, a star helps other SOC analysts find this work.}

_{Released under the MIT License. © 2026 Sandeep Mothukuri.}