Twinkle Kamdar

Conducted static and dynamic analysis of XMRig (Linux ELF cryptominer) via strace, tcpdump, and objdump in an isolated VM sandbox, confirming live C2 connection behavior, hardware-fingerprinting patterns, and container-evasion techniques. Designed a family-level YARA rule generalizing beyond XMRig to two independent miner codebases (xmr-stak, cgminer) with 0% false positives across a 1,319-binary clean corpus, and validated a complementary behavioral signal live via auditd. Performed static analysis of macOS malware from two independently attributed nation-state actors, OceanLotus/APT32 (Vietnam) and Lazarus Group/AppleJeus (North Korea), identifying AES-128 encrypted C2, a masquerading exfiltration technique disguised as image uploads, and a 3-year TTP evolution for OceanLotus. Analyzed the 2018 event-stream/flatmap-stream npm supply chain compromise, reverse-engineering the RSA-encrypted, environmentally-keyed payload that targeted the Copay Bitcoin wallet. Authored full CTI reports with MITRE ATT&CK mapping and TLP handling statements, and integrated findings into IRIS as a live detection endpoint.

Built a 5-layer real-time detection engine that catches indirect prompt injection, cross-agent collusion, and behavioral drift — attacks that bypass every standard defense. Core contribution: intent-action divergence detection using llama-3.3-70b to compare what an agent should do vs what it actually does. Red-teamed with Garak: 18 adversarial probes across 5 attack categories, 18/18 detected, zero bypasses. Every detection auto-mapped to the Lockheed Martin Cyber Kill Chain via MITRE ATLAS.

Multi-layered threat detection platform combining rule-based IDS, Isolation Forest, and CICIDS2017-trained Random Forest with ensemble voting. Deployed in a Mininet SDN environment with post-quantum crypto (Dilithium3 + Kyber768), SHA-256 tamper-evident audit ledger, self-healing watchdog, NIST CSF IR automation, and Kubernetes Zero Trust. XDR correlator maps detections to the Lockheed Martin Cyber Kill Chain in real-time across AEGIS, IRIS, and AWS Scanner. SOAR layer automates threat response with AbuseIPDB enrichment and SLA-tiered playbooks.

ML-driven network microsegmentation using XGBoost and DBSCAN on UNSW-NB15. Ryu OpenFlow 1.3 on Mininet with a real-time Flask event-stream dashboard. 95.31% accuracy and 100% cross-segment block rate.

Simulated Mirai botnet attacks using Security Onion for forensic analysis. Built custom Suricata IDS rules and deep network traffic analysis using Moloch/Arkime. Delivered a comprehensive forensic report covering attack vectors, IoC extraction, and detection signatures.

Command-line tool that scans AWS environments for security misconfigurations across IAM, S3, EC2, Security Groups, and more. Generates prioritized findings with remediation steps.

Cross-platform anti-forensics detection framework for Windows and Linux. Python rule engine targeting MFT timestomping, event log manipulation, prefetch tampering, and USN journal anomalies. Streamlit/Plotly dashboard for timeline reconstruction. Published research paper.

with Kaivalya & Aarya

Kubernetes threat detection integrating Security Onion (NSM), Falco (syscall monitoring), and Filebeat. Detected container escape, privilege escalation, and lateral movement. Handled SIEM architecture and detection engineering.