Cybersecurity / Blue Team
Bhanu Bastola
Aspiring SOC Analyst focused on alert triage, log-based threat hunting, and DFIR.
01 / Profile
Summary
Hands-on SOC training via a 3-month cybersecurity apprenticeship and TryHackMe's SOC Level 1 path, with applied DFIR work spanning Windows event-log hunting (Chainsaw, Sigma), timeline correlation (EvtxECmd), and MITRE ATT&CK mapping — across both simulated triage exercises and full multi-host investigations. Currently seeking a SOC Analyst internship to contribute to Nepal's growing cybersecurity operations.
02 / Featured Investigation
Latest field report
A phishing email impersonating a bank/loyalty program, triaged end-to-end: header/authentication analysis, CyberChef decoding of the embedded URL, and browser-based sandbox detonation (urlscan.io + ANY.RUN) — consolidated into an IOC table with only evidence-supported behavior mapped to MITRE ATT&CK (T1566.002).
03 / Case Studies
How I've approached real triage scenarios
Practiced in simulated SOC environments (TryHackMe labs). Each write-up below is my own reasoning and sanitized evidence, not a course completion badge. For full multi-host DFIR investigations, see the Field Reports page.
A SIEM alert fired for a file created with a double extension (e.g., disguising an executable as a document), flagged High severity on the SOC dashboard.
Reviewed the alert details and description, extracted the file's MD5 hash, and cross-referenced it against VirusTotal to check for known-malicious detections.
Classified as a true positive: the hash returned multiple malicious detections on VirusTotal, confirming the file was not a legitimate document and matched a phishing-delivered payload pattern rather than benign user activity.
Recommended isolating the affected host, blocking the file hash at the endpoint/network level, and flagging the delivery vector (likely email) for user-awareness follow-up.
An endpoint showed an unexpected process spawning from a user-facing application, prompting a closer look at what ran on the host around that time.
Reviewed process lineage and file system artifacts to establish a timeline, identified the parent-child process relationship, and checked the spawned process against expected application behavior.
Flagged as suspicious pending further review: the process relationship didn't match normal application behavior, warranting escalation rather than a same-session closure.
Documented the timeline and indicators for handoff, and noted what additional log sources would confirm root cause.
04 / Technical Skills
What I work with
SOC & Blue Team
- SIEM — Wazuh, Splunk, Elastic Stack (ELK)
- Alert Triage & Incident Reporting
- Digital Forensics & Incident Response
- Threat Detection & Log Analysis
- SOAR & EDR Concepts
Networking & OS
- Network Security & Vulnerability Analysis
- Linux Administration & Bash Scripting
- DNS, HTTP/S, TCP/IP Protocols
Programming & Tools
- Python (scripting & automation)
- HTML, CSS, JS
- SQL & Database Management
- Git / GitHub
Applied directly in the field reports and case studies above; see those for the specific tools and reasoning in context rather than a self-rated skill list.
05 / Experience
Where I've trained
Cybersecurity Apprenticeship
Skill Shikshya- Hands-on cybersecurity training covering network security and threat analysis
- Studied penetration testing concepts, network vulnerabilities, and digital forensics
- Applying SOC workflows and defensive security skills in a real-world context