Skip to content
View tanya-priya's full-sized avatar
🎯
Focusing
🎯
Focusing

Block or report tanya-priya

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
tanya-priya/README.md

🛡️ Hey there, I'm Tanya Priya

     

SOC Analyst • Detection Engineering • Threat Hunting

Focused on bridging the gap between adversary behavior and defensive investigation. I build detection pipelines and adversary emulation labs to master the how and why behind modern cyberattacks.

🗂️ Featured Blue Team Projects

🔬 Hunt-Forge: Behavioral Detection & Adversary Emulation Lab

A hands-on lab simulating post-compromise attacker workflows including PowerShell download cradles and LSASS credential dumping, to explore both automated and manual threat hunting.

Key Outcome: Conducted manual threat hunting across Sysmon event logs to reconstruct process execution chains (cmd.exe → powershell.exe → rundll32.exe) and authored custom Sigma detections for Living-off-the-Land techniques.
The Stack: Atomic Red Team, Sysmon, Sigma, Hayabusa.

🧩 Sigma-Unified: Cross-Platform Detection-as-Code Pipeline

A detection engineering project focused on standardizing security logic using Sigma and translating threat intelligence into actionable SIEM alerts.

Key Outcome: Developed a workflow to convert platform-agnostic Sigma rules into production-ready Wazuh detections for both Windows and Linux telemetry.
The Stack: Sigma, Wazuh XML Rules, Docker, wazuh-logtest

⚔️ Wazuh-EDR: End-to-End Incident Response & Forensic Lab

A multi-stage attack simulation demonstrating detection and investigation of SSH brute-force activity followed by privilege escalation.

Key Outcome: Reconstructed the attacker’s activity timeline by correlating auth.log and auditd telemetry, mapping events to MITRE ATT&CK techniques T1110 and T1078.
The Stack: Wazuh SIEM, Docker, Linux Auditd.

📊 PLG-Stack: Observability-Driven Security Monitoring

A lightweight security monitoring pipeline for centralized Linux authentication telemetry using an observability-based log stack.

Key Outcome: Designed a log ingestion and analysis workflow using LogQL to detect SSH brute-force attempts and suspicious sudo activity in real time.
The Stack: Promtail, Loki, Grafana.

📑 Additional Projects

Suricata-IDS: Deployed and configured Suricata to detect network reconnaissance activity, analyzing EVE.json telemetry generated from simulated Nmap scans.

Auditd-Watch: Implemented Linux audit rules to monitor sensitive files and privilege escalation attempts, analyzing kernel-level events for forensic investigation.

Wazuh-SIEM: Integrated Linux audit telemetry into Wazuh and configured log ingestion to generate security alerts, enabling investigation of privileged command execution.

⚙️ Security Skills & Tooling

Category Tools & Frameworks
SIEM / Telemetry Wazuh, Sysmon, Auditd
Detection Engineering Sigma Rules, Wazuh XML Rules, LogQL
Threat Hunting MITRE ATT&CK, Atomic Red Team, Hayabusa
Network Security Suricata IDS, Nmap
Forensics & Analysis Ausearch, Aureport, Windows Event Log Analysis
Log Pipeline / Observability Promtail, Loki, Grafana
Environment Docker, KVM/Virt-Manager, Ubuntu 24.04, Windows 10 Pro

📡 Connect with me

  "Visibility is the first step toward defense."

Pinned Loading

  1. hunt-forge hunt-forge Public

    A blue team Windows adversary emulation lab using Atomic Red Team in a virtualized environment, combining Sysmon telemetry, Sigma rules mapped to MITRE ATT&CK, Hayabusa, and manual threat hunting a…

  2. sigma-unified sigma-unified Public

    Detection engineering project using Sigma rules, converted SIEM queries, and Wazuh XML rules to detect real-world attack techniques mapped to MITRE ATT&CK.

  3. wazuh-edr wazuh-edr Public

    SOC incident response lab using Wazuh SIEM and auditd to detect SSH brute-force attacks and privilege escalation with MITRE ATT&CK mapping in a virtualized attacker–victim environment.

    Shell

  4. plg-stack plg-stack Public

    A real-time SOC monitoring pipeline using the PLG stack (Promtail, Loki, Grafana) to ingest, analyze, and visualize Linux authentication logs and detect SSH brute-force attempts.