Ayan Bhowal

Threat Intelligence Investigations: From Advisory to Detection

This repository is a collection of real-world inspired Cyber Threat Intelligence (CTI) investigations designed to demonstrate the workflow followed by a SOC & Threat Intelligence Analyst. Each case study begins with a publicly available threat advisory, vulnerability disclosure, ransomware campaign, phishing operation, or data breach report. The investigation then follows the analyst's thought process—from understanding the threat and extracting Indicators of Compromise (IOCs) to threat hunting, detection engineering, and recommending defensive actions. The objective is not to reproduce proprietary threat intelligence, but to showcase the methodology, analytical reasoning, and technical processes used to convert threat intelligence into actionable security operations.

Enterprise Malware Incident Response & Root Cause Analysis (SOC Case Study)

This project presents a real-world SOC malware incident response case study, covering the full lifecycle of an enterprise endpoint security incident—from EDR detection and SIEM correlation to root cause analysis (RCA), containment, remediation, and reporting. The incident was detected using Microsoft Defender for Endpoint and correlated through Microsoft Azure Sentinel in a Microsoft 365 enterprise environment. The investigation involved alert triage, process tree and attack story analysis, device timeline correlation, behavioral malware analysis, live response validation, and cross-device scoping to accurately assess impact and prevent lateral movement. The malware leveraged scheduled task–based persistence and defense evasion techniques, but was successfully contained with no data exposure, no business disruption, and minimal user impact. All data has been sanitized and anonymized to comply with organizational security and confidentiality requirements.