status: actively investigating

I read the traffic
everyone else scrolls past.

Katreddy Gowtham Kumar Reddy — SOC Analyst aspirant. I trace malware from raw packet to confirmed IOC, then turn what I find into detection rules that catch it automatically next time.

01 — About

Still early. Already methodical.

I'm building toward a SOC Analyst role by working the way one actually does: take a real, publicly documented malware sample, investigate it from raw packets up, extract the indicators of compromise, and validate every finding against threat intelligence before writing it down.

What I don't do is stop at "I found something suspicious." Each investigation ends with a decision — is this a true positive, what does it mean, and how would I stop it from happening again. That last part is what pushed me into detection engineering: writing Suricata rules that turn a one-time finding into an automated, repeatable alert.

I'm not claiming production SIEM experience I don't have. I'm showing the underlying instincts — evidence-based conclusions, honest limitations, and a habit of documenting the "why," not just the "what" — that I think matter more at this stage.

Case files published04
Detection rules written01
Alerts validated (single rule)264
Core telemetry coveredEndpoint + Network
Currently learningWireshark deep analysis
02 — Case Files

Investigations, in order.

Each one moves further down the stack — from watching endpoint behavior, to reading raw traffic, to shipping a rule that detects it on its own.

NetSupport RAT — Suricata C2 Detection
Detection Engineering

Took a confirmed C2 beacon pattern from prior traffic analysis and encoded it into a working Suricata rule — tested offline against the source PCAP and validated with real alert output, not a simulated result.

alert: http POST → 45.131.214.85/fakeurl.htm   result: 264 matches / ~60s beacon interval
suricataidsdetection-engineeringblue-team
View repository ↗
Endpoint Detection & Response Lab
Detection Engineering

Built a custom Sysmon configuration to catch a simulated six-stage attack chain — initial access through C2, LSASS credential access, ransomware-style file drops, and registry-based persistence.

telemetry: Sysmon   stages covered: 6, mapped to attacker lifecycle
sysmonedrwindows-securitythreat-hunting
View repository ↗
Malware PCAP Analysis — Easy As 123
Traffic Analysis

Identified a NetSupport Manager RAT infection from a public traffic capture — full IOC extraction, cross-validated against VirusTotal and ANY.RUN, with explicit limitations noted rather than overstated.

confirmed: C2 IP, malicious domain, user-agent, HTTP URI
pcap-analysiswiresharkiocthreat-intelligence
View repository ↗
Malware PCAP Analysis — 01
Traffic Analysis

First traffic investigation — RedLine-adjacent malware sample, IOCs pulled via command-line filtering and verified through VirusTotal and AbuseIPDB, closing with a self-directed list of skill gaps to address next.

tools: tcpdump, Wireshark, VirusTotal, AbuseIPDB
pcap-analysistcpdumpnetwork-forensics
View repository ↗
03 — Skills

What I actually reach for.

Investigation

  • Packet-level traffic analysis
  • IOC identification & extraction
  • tcpdump / Wireshark / tshark
  • Threat intel cross-validation

Detection Engineering

  • Suricata rule writing
  • Sysmon configuration
  • False positive / true positive reasoning
  • MITRE ATT&CK mapping (in progress)

Foundations

  • Linux / Kali command line
  • Git & GitHub workflows
  • Structured, evidence-based reporting
  • Currently building: SIEM exposure (Wazuh)