Building a Phishing Detection Automation: From Unfinished Business to 45-Second Analysis : manishrawat21.substack.com/p/building-a... #Cybersecurity #Blueteam #AI #Technology #Automation #DetectionEngineering

Building a Phishing Detection Automation: From Unfinished Business to 45-Second Analysis

Sometimes things don’t go according to your plan. But sometimes, it just checks whether you have the potential or not.

manishrawat21.substack.com

Community-recognized detection engineering project featured by TLDRSec and Detection Engineering Weekly. Github: github.com/manishrawat2... #DetectionEngineering #SecurityAutomation #ThreatIntelligence #BlueTeam #OpenSource

GitHub - manishrawat21/Cisa-KEV-Threat-Intel-Orchestrator: Zero-touch pipeline that turns newly weaponized CVEs from the CISA Known Exploited Vulnerabilities (KEV) catalog into production-ready Sigma ...

Zero-touch pipeline that turns newly weaponized CVEs from the CISA Known Exploited Vulnerabilities (KEV) catalog into production-ready Sigma detection rules, automatically, every week. - manishrawa...

github.com

My CISA KEV threat intel orchestrator got featured in Detection Engineering Weekly 164 this week, alongside tools from Sublime Security and a few other legit projects in the space. Repo: github.com/manishrawat2... DEW: www.detectionengineering.net/p/dew-164-yo... #cybersecurity #github #Detection

49% of cyberattacks use PowerShell to hide in plain sight for almost a year. Learn how to close this multi-million dollar blind spot and catch fileless malware in Episode 2 of The Threat Hunter’s Notepad. 🎧 Listen here: open.substack.com/pub/manishra... #BlueTeam #Cybersecurity #SOC #podcast #detect

Episode 2: The PowerShell Detection Gap (And How We Fix It)

49% of modern cyberattacks use PowerShell, yet attackers hide for almost a year. Here is how we used 196,000 Sysmon events to build a Sigma rule that actually catches fileless malware.

open.substack.com

☠️ Welcome to "Zero to Sigma: Breaking Down the KEV" 🔎 EP-1 : Cisco Catalyst SD-WAN Manager vulnerability CVE-2026-20245 is a critical improper encoding and escaping vulnerability targeting the Cisco Catalyst SD-WAN Manager, a core component for enterprise routing. #cybersecurity #cisa #threatintel

I built a zero-touch threat intelligence pipeline that completely automates CISA KEV tracking and Sigma rule generation. Check out my Github repo for full documentation: github.com/manishrawat2... #CyberSecurity #ThreatIntelligence #SOC #Automation #SigmaRules #GeminiAI #n8n #InfoSec #CyberDefense

🛑Stop writing Sigma rules by hand! I got tired of spending 6 hours analyzing every new CISA KEV vulnerability, so I built a zero-touch pipeline that does it in 0 minutes. 👉 Read the full engineering breakdown on Medium! (Link in the comment) #Cybersecurity #SOC #Automation #n8n #ThreatIntelligence

Hit a hard API rate limit while building an AI phishing detector in n8n. Instead of hacking a bypass, I ripped the AI out and rebuilt the pipeline with standard IOC extractors and VirusTotal. Full Analysis is in comment section. #Cyberseccurity #N8N #AI #DetectionEngineering #SecurityAutomation

What if everything you're good at is just solving problems nobody's paying for yet Been thinking about this all day. most people are undercharging for skill they already have. The gap between "good at something" and "rich from something" isn't skill. it's positioning.

Do not wait for a breach. Just apply them to your environment and hunt the anomalies you missed. I just pushed 3 production #Sigma rules to my #GitHub to fix that: 1. Abnormal PowerShell (EventID 1) 2. DLL Staging (EventID 7) 3. LSASS Credential Dumping #ThreatHunting #Cybersecurity #RemoteWork

EventID 1 catches the payload. EventID 7 catches the preparation. I built a #Sysmon rule correlating executing process paths with loaded module paths to catch #adversary staging in Temp directories. Stop waiting for #execution. #Hunt the staging phase. Full logic on my GitHub. #Cybersecurity #APT

I just published "Why my last deep dive taught me more than any certification" on Medium. #Cybersecurity #Certification #analysis #Blog #Medium

Now its 100+ security practitioners cloned them. Try out for yourself and detect anomalies without a hassle. #SOC #Cybersecurity #ThreatHunting #DetectionEngineering #SigmaRules

Manish_SOC_Analyst@manishrawat21.bsky.social · 4mo ago

I published my #Sigma #detection rules on GitHub last month. Within 2 weeks, 78 #security practitioners downloaded them. That number matters to me, not because it's big (it's not), but because it means other people are using rules I wrote to #defend. For more: substack.com/profile/4462... #SOC

Years of log analysis taught me one thing: context beats volume. I don't hunt EventIDs anymore. I hunt attack sequences. Full analysis: open.substack.com/pub/manishra... #Cybersecurity #Cyberattack #Substack #ThreatHunting #DetectionEngineering #SOC #BlueTeam

I published my #Sigma #detection rules on GitHub last month. Within 2 weeks, 78 #security practitioners downloaded them. That number matters to me, not because it's big (it's not), but because it means other people are using rules I wrote to #defend. For more: substack.com/profile/4462... #SOC

manishrawat21 - Overview

Detection Engineer | SOC Automation | Threat Hunting | Building detection systems that catch real attacks | Open to remote opportunities - manishrawat21

github.com

#opentowork #SOCAnalyst #ThreatHunter #Remotejobs I analyzed 196,071 APT29 events and wrote detection rules that actually caught the attacks. Now looking for remote SOC/Detection Engineering roles. Immediate joiner. Github: github.com/Manishrawat21/

Manishrawat21 - Overview

Soc Analyst | Threat Hunter | Detection Engineer | Building better threat detection frameworks | Authored Detection Rules| Open to Opportunities - Manishrawat21

github.com

Manish_SOC_Analyst@manishrawat21.bsky.social · 4mo ago

Looking for remote SOC/Detection Engineering roles. Immediate joiner www.linkedin.com/posts/manish... #Opentowork #SocAnalyst #ThreatHunter #Cybersecurity #JobHunt

Looking for remote SOC/Detection Engineering roles. Immediate joiner www.linkedin.com/posts/manish... #Opentowork #SocAnalyst #ThreatHunter #Cybersecurity #JobHunt

#opentowork #threathunting #detectionengineering #socanalyst #cybersecurityjobs #siem #splunk #blueteam #infosec #remotejobs #hiringnow #securityanalyst #cybersecurity #talentacquisition… | Manish Raw...

I analyzed 196,071 APT29 events and wrote detection rules that actually caught the attacks. Now looking for remote SOC/Detection Engineering roles. Immediate joiner. Two years hunting threats that mo...

linkedin.com

I just posted my new article on #substack on how to detect abnormal #powershell activity. Feel free to share it. #Substack : open.substack.com/pub/manishra... #ThreatIntel #Detection #SigmaRules

77% of attacks now use fileless #PowerShell to bypass traditional AV. I analyzed 196,071 APT29 Sysmon events and built a Sigma rule that catches these patterns before they become breaches. Validated against real ransomware attacks. github.com/Manishrawat2... #CyberSecurity #ThreatHunting #Detection

GitHub - Manishrawat21/Detection-Rules: This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was tested against the actual attack data...

This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was tested against the actual attack data, converted to Splunk SPL, and valida...

github.com

Started from 0 on #Substack. No audience. No reach. 30 days of building in public. 520+ views 6 subscribers Not big numbers. But a start. Growth is slow in the beginning, but it’s real. If you're into blue team work, feel free to follow along. Link is in the comments. #Notes #Reads #Views #Blog

Writing some techniques, what to look for and where to look in each EventID's. Follow me on Github and LinkedIN to get more detection techniques. LinkedIN: www.linkedin.com/in/manishraw... Github: github.com/Manishrawat21/

Manishrawat21 - Overview

Detection Engineer | Building better threat detection frameworks - Manishrawat21

github.com

My First APT focused Sigma Detection Rule: LSASS Access. - It detects Powershell.exe or cmd.exe accessing lsass.exe with full or near full access rights. Link: www.linkedin.com/posts/manish... #Sigma #DetectionRule #APT #Cybersecurity #substack #LinkedIn

Part 4 of my APT29 #analysis is live. I found the lateral movement command line with hardcoded credentials sitting in plain text. This is what lateral movement actually looks like when you're hunting. Check out the comment section for link. #psexec #Cybersecurity #Breach #Detection #SOC #APT

SOC Breakdown: EventID=3 - Records when a process initiates a network connection, including source and destination details. Things you should look for: - Image - Protocol - SourceIp - SourcePort - DestinationIp - DestinationPort #SPL Check out my full post on #substack substack.com/@manishrawat...

Manish Rawat (@manishrawat21)

SOC Breakdown: EventID=3 - Records when a process initiates a network connection, including source and destination details. Things you should look for :- - Image (The process initiating the network...

substack.com

I just published Hunting APT29 Part 3: I Traced the Process Tree Back to the Beginning systemweakness.com/hunting-apt2... #Cybersecurity #Substack #APT #ThreatHunting #DetectionEngineering #Splunk #Analysis

My First False Positive | I spent an hour investigating a lsass process in the APT29 dataset this week. 1,605 events. 14 EventIDs. Every search I ran came back clean. Full Post is on LinkedIn: www.linkedin.com/posts/manish... #Cybersecurity #Analysis #Splunk #Research #APT #SecurityAnalyst #SOC

#threathunting #splunk #apt29 #blueteam #detectionengineering #mitre #soc #falsepositive | Manish Rawat

I spent an hour investigating a lsass process in the APT29 dataset this week. 1,605 events. 14 EventIDs. Every search I ran came back clean. Signed DLLs. Legitimate file paths. Normal GrantedAcces...

linkedin.com

Started from 0 on #Substack. No audience. No reach. 14 days of building in public. 176+ views 3 subscribers Not big numbers but real ones. Building in public. PART-3 of APT Threat hunting #analysis coming next. The Substack link in the comments. #cybersecurity #Notes #Blogs #Reads #Views #APT

1 ProcessID, 1129 events, 12 EventID's. In 2 seconds the process loaded 60 images. It created rar.exe and sdelete.exe. It made 348 identical outbound connections in 3 seconds except for the source port. It accessed cmd.exe and powershell.exe. Full breakdown with #SPL queries in the first comment.

Started from 0 on #Substack. No audience. No reach. 7 days later: → 65 views → 2 subscribers Not big numbers but real ones. Building in public. Threat hunting logs coming next. #Cybersecurity #Notes #Blogs #reads #Views

Sometimes you get things where you least expected. While investigating the breached dataset in #splunk, I encountered this EventID, which at first looks completely noisy, but as soon as I pivoted to its ProcessGuid, I found a complete attack chain. Writing this up for Part 2 on Monday. Part 1👇👇