Yamini Savalia

A multi-stage attack simulation across a corporate environment — from initial perimeter breach to active C2 communication — investigated entirely through Elastic SIEM log analysis. The scenario involves no pre-generated alerts or guided triage queues. Detection, correlation, and attribution are driven by raw KQL queries across network, endpoint, and authentication telemetry spanning four compromised hosts. The attack surface covers SSH brute force, web application exploitation, phishing-delivered payloads, process injection, defense evasion, persistence mechanisms, and three simultaneous C2 channels — making this a representative sample of what a real lateral movement investigation looks like in a production SOC environment. The attacker used a layered attack: SSH brute force → web shell → malicious LNK file → process injection → defense evasion → persistence → multi-channel C2 (DNS tunneling + Discord + CDN abuse). Each stage required pivoting between log sources and chaining evidence across hosts.

I have spent four years working SOC alerts — triaging EDR hits, investigating phishing, pulling logs during incidents. But at some point I started wondering: how do these detections actually get built? Who wrote the original rule that caught the thing I'm investigating? That question is what led to this project. This repo documents my path from learning SPL basics all the way to authoring production-grade detection rules from scratch — picking a real MITRE ATT&CK technique, simulating it in an isolated lab, capturing the actual logs it generates, writing a Sigma rule, converting it to Splunk SPL, and working through every scenario that would cause it to fire incorrectly in production. The detection engineering project (Project 03) took the most time. I ran every technique myself in a lab environment and documented exactly what I observed — including the things that didn't work the way I expected, the detection gaps I found in default Windows configurations, and the places where I had to adapt on the fly.