Hey — I'm Karan. I build the alarms that ruin an attacker's afternoon.
I'm a SOC analyst working in detection engineering. I put a seven-host lab in my apartment, wrote nine detection rules mapped to MITRE ATT&CK, then attacked the whole thing myself to check they actually fired. Some of them didn't. That part turned out to be the useful part.
I also play chess, which is the same job with better lighting. You don't respond to the move that was just played — you work out what it sets up three moves from now. A single SMB session is nothing. A single SMB session eight minutes after a credential dump is a story.
Before this: contract IT support — Active Directory, Windows Server, and the particular patience required by a printer that works for everyone except one guy in accounting. CompTIA CySA+ exam booked. Based in Oshawa, Ontario.
Open to work — Tier 1 SOC, security operations, vulnerability management
Detections
Rules I wrote in my lab. Open one to see the query, what I tuned, and why.
Elastic SIEM · lab.internal[░░░░░░░░░░░░░░]
What fired
A process opened a handle to lsass.exe with read-memory access rights. Credential dumpers need that access. Very little else asks for it.
The rule
event.code : "10"
and winlog.event_data.TargetImage : "*\\lsass.exe"
and winlog.event_data.GrantedAccess : ("0x1010" or "0x1410" or "0x143a")
and not process.executable : ("*\\MsMpEng.exe" or "*\\wmiprvse.exe")
What tuning taught me
The first version fired 40+ times a day on Defender and WMI. I filtered on the granted-access mask instead of the process name. A renamed dumper still needs the same access rights, so the rule still catches it.
PowerShell launched with -enc and a base64 blob. Encoding alone isn't suspicious; plenty of management tooling does it. The rule keys on the parent process instead.
The rule
process.name : "powershell.exe"
and process.command_line : ("*-enc*" or "*-EncodedCommand*")
and process.parent.name : ("winword.exe" or "excel.exe"
or "outlook.exe" or "wscript.exe")
Why the parent matters
An Office app spawning an encoded shell is the macro chain. Scoping to those four parents dropped false positives to zero across two weeks of lab traffic.
I ran the attack myself: Metasploit against the vulnerable host, then back to the console cold to see what the stack had caught.
The gap it exposed
Zeek flagged the exploit traffic. The endpoint side showed nothing, because the target is Linux and I hadn't put an agent on it. That gap is now on the coverage map.
One simulated intrusion, in the order I saw it, with the call I made at each stage.
T+00:00
Macro-borne execution on a workstation
Sysmon EID 1 shows winword.exe spawning powershell.exe with an encoded command. The parent-process rule fires within seconds.
→ Confirmed true positive, isolate host
T+00:04
Discovery, quiet and unalerted
The shell enumerates domain users and local groups. Nothing fired: I had the telemetry but no rule. Discovery needs volumetric rules, not signatures.
→ Documented as detection gap
T+00:11
Credential access on the domain controller
A handle opens against lsass.exe with dump-capable access rights. At this point it stops being a workstation problem.
→ Escalate, assume domain credentials exposed
T+00:19
Lateral movement over SMB
Zeek shows admin-share access to a second host minutes after the credential theft. The SMB session alone would have been ambiguous; the sequence isn't.
→ Contain both hosts, force credential reset
T+01:30
Write-up and rule changes
Documented the chain, added the missing discovery rule, and re-ran the same attack to confirm it fired.
Mapped to MITRE ATT&CK. Gaps included, because I have some.
0
hosts in the lab
0
techniques mapped
0
detections tested
0
documented gaps
✓Written and tested~Telemetry, rule not tuned·Known gap
Initial access
Execution
Persistence
Credential access
Lateral movement
Command and control
Pick a technique to see what the lab does about it.
Experience
Roughly in reverse. The useful bits, not the job descriptions.
2026 — now · Oshawa
Blue team track — mentored, 10–15 hrs a week
I gave myself sixteen weeks and a stack of VMs. What came out the other end is the lab this whole site is about: 9 rules written, tuned and verified by attacking my own network, 18 techniques mapped, and 3 gaps I can name out loud. The gaps took longer to find than the detections. CySA+ sits at the end of it, booked.
Elastic SIEM
Sysmon
Zeek
KQL
MITRE ATT&CK
Sep 2025 — now · independent
Security Health Check — my own thing
Small businesses with no IT person, which in practice means one laptop holding the whole company and a router nobody has logged into since it was installed. I check identity hygiene, patching, endpoints, backups and what's exposed to the internet, then write it up in language the owner can act on. Nothing goes in a report until I've tested it in my own lab first.
Assessments
Threat intel
Reporting
Jan — Aug 2025 · Oakville
IT Support Technician at Logic Play Web Solutions
Eight months of tickets — 60+ a month through ServiceNow and Jira, 90% closed first contact. A lot of it was Active Directory: permissions nobody had reviewed in years, onboarding that ran on tribal knowledge. I wrote the runbooks mostly so I'd stop answering the same question twice, and mean response time fell 20%. That's also where I learned to read a packet capture, which turned out to matter more than anything else on this list.
Active Directory
Windows Server
Azure AD
PowerShell
ServiceNow
Jira
School
Cybersecurity Graduate Certificate at Durham College
Splunk forwarders, Zabbix SNMP, joining Linux boxes to a Windows domain with SSSD and Kerberos, standing up a PKI with AD Certificate Services. Before that, a Network Management diploma at LaSalle and a Bachelor of Computer Applications.
Cisco Networking Academy — CCNA: Enterprise Networking, Security and Automation, Jan 2025. The course certificate, not the 200-301 exam — that one I'm still working on, and I'd rather say so than let you assume.
The lab
Seven hosts, set up and logged by me.
lab.internal/
├── siem/ elastic 8.x · kibana · fleet server
├── endpoint/ sysmon · elastic agent
├── network/ zeek 6.x · conn, dns, http, ssl
├── perimeter/ pfsense ce · attack | victim | monitor
├── identity/ windows server ad · ad cs · gpo · sssd
├── offense/ kali linux · metasploit
├── targets/ metasploitable 2
└── secondary/ security onion 2.4 · splunk uf · zabbix
Security Onion runs in EVAL mode because of RAM limits. Zabbix monitoring broke early on from DHCP-driven IP drift, which is how I learned to pin the monitored hosts.
Technical stack
Off the clock
A knight fork. One move, two threats — and the reason I alert on sequences, not single events.
The queen isn't in danger. The king isn't in danger. Both of them together, after one knight lands on e6 — that's the whole game.
Detection works the same way. A logon is noise. A service install is noise. A logon, then a service install on a domain controller ninety seconds later, is an incident.