manishrawat21/analysisHands-on analysis of common APT attack techniques, focused on how they show up in logs and how defenders can realistically detect them.
This repository documents hands on detection research based on lab testing, log analysis, and real SOC workflows.
The focus is on how attacker techniques actually appear in logs, what detection logic works in practice, what fails, and where false positives are introduced. All content is written from a defensive perspective for analysts and detection engineers.
This is not offensive tooling or exploit development.
Analysis and detection notes for DLL hijacking and side loading activity on Windows systems.
Topics covered:
Common false positives identified:
The emphasis is on separating expected application behavior from activity that actually warrants investigation.
Research into how encoded PowerShell commands appear in logs and how attackers evade simple detections.
Includes:
All testing is performed with realistic telemetry rather than ideal enterprise setups.
Effective detection is rarely about single indicators.
This repository focuses on:
Guiding question: Would this detection survive in a real SOC environment?
Interested in working with teams on:
If you're solving hard detection problems, let's talk.
If you find this repository useful or learn something from it, consider giving it a star.
It helps the research reach more analysts and encourages continued work.
GitHub
https://github.com/Manishrawat21
LinkedIn
https://www.linkedin.com/in/manishrawat-soc/
Medium
Detection write ups and lab based research
All queries and detection logic are starting points and should be adapted to your environment.
This repository evolves as new detection research is added.
