Katreddy Gowtham Kumar Reddy — SOC Analyst aspirant. I trace malware from raw packet to confirmed IOC, then turn what I find into detection rules that catch it automatically next time.
I'm building toward a SOC Analyst role by working the way one actually does: take a real, publicly documented malware sample, investigate it from raw packets up, extract the indicators of compromise, and validate every finding against threat intelligence before writing it down.
What I don't do is stop at "I found something suspicious." Each investigation ends with a decision — is this a true positive, what does it mean, and how would I stop it from happening again. That last part is what pushed me into detection engineering: writing Suricata rules that turn a one-time finding into an automated, repeatable alert.
I'm not claiming production SIEM experience I don't have. I'm showing the underlying instincts — evidence-based conclusions, honest limitations, and a habit of documenting the "why," not just the "what" — that I think matter more at this stage.
Each one moves further down the stack — from watching endpoint behavior, to reading raw traffic, to shipping a rule that detects it on its own.
Took a confirmed C2 beacon pattern from prior traffic analysis and encoded it into a working Suricata rule — tested offline against the source PCAP and validated with real alert output, not a simulated result.
View repository ↗Built a custom Sysmon configuration to catch a simulated six-stage attack chain — initial access through C2, LSASS credential access, ransomware-style file drops, and registry-based persistence.
View repository ↗Identified a NetSupport Manager RAT infection from a public traffic capture — full IOC extraction, cross-validated against VirusTotal and ANY.RUN, with explicit limitations noted rather than overstated.
View repository ↗First traffic investigation — RedLine-adjacent malware sample, IOCs pulled via command-line filtering and verified through VirusTotal and AbuseIPDB, closing with a self-directed list of skill gaps to address next.
View repository ↗