Apr 2023 – Jan 2026 · 2 yrs 9 mos · United Kingdom · Remote

• Authored and led end-to-end blue team campaign called Operation Salwaar Kameez, developing defensive content on reverse engineering Node.js malware, Windows downgrade attacks, firmware forensics, and SQL anomaly detection, strengthening Hack The Box’s platform value and driving increased player engagement.
• Developed numerous blue team challenges focused on real-world defense, helping both community and enterprise users sharpen their cybersecurity skills and strengthening Hack The Box’s platform.
• Designed and authored multiple advanced defensive “Sherlock” investigations simulating real-world attacker tradecraft across Windows endpoints (Win32 API’s), AI attack simulation and ransomware scenarios.
• Emulated techniques used by Sliver C2, Mustang Panda, and Uroburos, including malicious archive delivery, virtual disk payload concealment, and CVE-2023-49103 exploitation, mapped to MITRE ATT&CK.

Feb 2020 – Mar 2023 · 3 yrs 1 mo · Bangalore Urban, Karnataka, India · Remote

• Helped achieve 98% visibility during MITRE Engenuity 2022 by emulating a wide range of attacker techniques during internal purple team exercises.
• Studied threat actors such as APT29, FIN7, Carbanak, Wizard Spider and Sandworm to identify and abstract related Tactics, Techniques, and Procedures (TTPs) and developed automated test cases of such TTP's to test against content and products.
• Studied different process injection techniques and developed automated test cases of such techniques in Caldera.
• Created custom Mimikatz binaries to bypass detections by endpoint security solutions.
• Developed C/C++ binary to emulate “Data Encryption for Impact” technique as that of a Ryuk and NotPetya ransomware.
• Studied windows internals and developed a new tool to bypass endpoint security solutions.

Aug 2019 – Feb 2020 · 6 mos · Greater Bengaluru Area

• Web application and thick client Penetration testing.
• Penetration testing of Industrial Control Systems.
• Contributed to the open source community by developing a vulnerable thick client.

Apr 2017 – Jul 2019 · 2 yrs 3 mos · Bengaluru, Karnataka, India

• Reported a bypass technique for an endpoint and response solution during its control validation.
• Conducted internal penetration testing on a web application and reported bugs with high, medium and low severity.
• Developed customized shellcode using assembly level language(32-Bit) and also a python script that generates shellcode for specified attacker IP and port.
• Detected malicious activities on endpoint by studying TTP's in MITRE ATT&CK framework.
• Developed correlation rules in Splunk, exercised internal threat hunting using splunk by collecting logs from EDR solutions, firewall and IPS/IDS.

Mar 2017 – Apr 2017 · 1 mo · Remote

• Reported a remote code execution vulnerability in a CMS based web application.
• Studied and developed exploits such as buffer-overflows and SEH overflows for applications as part of learning exercise.