Abhishek Yarnalle

SOC Analyst

Mumbai, MH 400601 2+ yrs exp 85 · Excellent

About

Dedicated SOC Analyst with 2.4+ years of experience in security monitoring, Splunk Enterprise Security (ES), Microsoft Defender for Endpoint and Microsoft O365 Defender. Investigating Windows security alerts and expertise in alert triage, malware analysis, IOC analysis, phishing investigations, and security incident escalation. Strong understanding of SIEM, EDR/XDR (SentinelOne), MITRE ATT&CK Framework, Cyber Kill Chain and the complete Incident Response Lifecycle.

Skills & Expertise (23)

Microsoft Defender for Endpoint Advanced

8.0/10

2.4

Years Exp

Incident Response Intermediate

7.5/10

2.4

Years Exp

Threat Intelligence Intermediate

7.0/10

2.4

Years Exp

Malware Analysis Intermediate

7.0/10

2.4

Years Exp

Active Directory Intermediate

6.5/10

2.4

Years Exp

Network Traffic Analysis Intermediate

6.5/10

2.4

Years Exp

Phishing Investigation Intermediate

6.5/10

2.4

Years Exp

MITRE ATT&CK framework Intermediate

6.0/10

2.4

Years Exp

Alert Triage Cyber Kill Chain IPS IDS Firewall Monitoring Microsoft O365 Defender Incident Investigation Windows Server SIEM Monitoring SentinelOne IOC Analysis Microsoft Sentinel Persistence Detection Windows Event Logs Windows 10/11

Work Experience

SOC Analyst

CyberNX Technologies Pvt Ltd

Apr 2024 - Present

Monitored 24/7 and investigated security alerts using Splunk Enterprise Security (ES) and Microsoft Defender for Endpoint and EDR/XDR(SentinelOne). Investigated phishing emails using Microsoft O365 Defender and performed email analysis. Analyzed Windows security alerts, including persistence, lateral movement, RDP, and LSASS memory access alerts. Investigated malicious process execution and suspicious PowerShell activities. Investigated password spray attacks by analyzing authentication logs and identifying affected user accounts. Investigated Kerberos-related attacks, including Kerberoasting and suspicious Kerberos authentication activity. Monitored and investigated Command and Control (C2) communication alerts. Investigated malware-related alerts and supported malware analysis. Analyzed firewall, proxy, IDS/IPS, and network security alerts. Reviewed endpoint and user activities to identify suspicious behavior. Validated indicators of compromise (IOCs) such as IP addresses, URLs, domains, file hashes, and processes. Investigated NTLM authentication attacks and suspicious NTLM logon events. Investigated Man-in-the-Middle (MITM) attack indicators and suspicious network communications. Investigated fileless malware attacks using process behavior, PowerShell activity, WMI, and command-line analysis. Investigated malicious process execution alerts by analyzing process trees, command-line arguments, network connections and parent-child relationships using EDR tools. Collaborated with security and IT teams for incident response and remediation. Followed incident response procedures to contain and resolve security incidents.