CASE_0721HIGH
OAuth Device-Code Authentication
Suspicious OAuth device-code authentication activity identified in an anomalous context. Investigation focused on authentication behavior, associated sessions, and potential unauthorized access.
SYSTEM STATUS: OPERATIONAL
CYBERSECURITY ANALYST // MDR // BLUE TEAM
DARKANGEL777
Hello, I'm Arvind, a Software Engineering graduate based out of Chennai, with 4 years of experience in cybersecurity across EY and Sophos. I currently work as a Cyber Threat Analyst in a Managed Detection and Response (MDR) environment, where I help strengthen the security posture of organizations through threat hunting, incident investigation, malware analysis, and proactive threat detection.
4+YEARS EXPERIENCE
MDRSECURITY OPERATIONS
24/7THREAT RESPONSE
01 //
ABOUT // ARVIND
The analyst behind the handle.
Throughout my career, I've worked in 24×7 MSSP/MDR environments, supporting customers across diverse industry verticals including BFSI, FMCG, healthcare, manufacturing, education, technology, and professional services. This experience has given me the opportunity to investigate threats across endpoint, network, identity, cloud, and SaaS environments, while working with diverse security technologies and constantly evolving attack surfaces.
My work revolves around understanding how attackers think, operate, and evolve — from analyzing suspicious PowerShell and malware activity to hunting for persistence, credential access, lateral movement, command-and-control communication, and ransomware behaviors. I focus on turning these investigations into actionable intelligence, detection improvements, and defensive measures.
02 //
OPERATIONS
Sanitized investigation case studies demonstrating how I approach detection, triage, correlation and response.
CASE_0694HIGH
DLL Side-Loading Investigation
Triaged suspicious trusted-executable behavior, established process lineage, identified the loaded DLL and validated endpoint remediation.
CASE_0658HIGH
Impacket WMI Lateral Movement
Analyzed remote WMI execution patterns consistent with Impacket tooling, reviewing source host, account context, command execution and lateral movement indicators.
CASE_0612MEDIUM
PowerShell Obfuscation & Compression
Decoded Base64 content, decompressed the embedded payload, reconstructed execution intent and correlated network activity for maliciousness assessment.
03 //
INVESTIGATION METHOD
From the first signal to detection improvement — a repeatable analytical workflow.
01DETECT
02TRIAGE
03CONTEXTUALIZE
04INVESTIGATE
05CORRELATE
06CONTAIN
07HUNT
08IMPROVE
04 //
ARSENAL
Tools, technologies and analytical domains used across security operations and investigations.
MDR / XDR
Threat Hunting
Endpoint
Identity / Cloud
Investigation
Network
05 //
ADVERSARY TRADECRAFT
Examples of ATT&CK-aligned behaviors I investigate during security operations.
01INITIAL ACCESSPhishing / Valid Accounts
02EXECUTIONPowerShell / WMI
03DEFENSE EVASIONObfuscation / DLL Side-Loading
04CREDENTIAL ACCESSLSASS / SAM / Tokens
05LATERAL MOVEMENTWMI / Remote Services
06COMMAND & CONTROLWeb / DNS / RMM