Sahil Vakkani

At LTIMindtree, I investigate endpoint threats across Microsoft Sentinel, Splunk, and QRadar, triaging AV and EDR alerts and mapping findings to MITRE ATT&CK.

I've performed static and dynamic malware analysis on loaders, stealers, ransomware, phishing documents, and obfuscated scripts while maintaining 100% accuracy within strict SLAs. I also lead phishing investigations through header analysis, DKIM/SPF/DMARC validation, URL detonation, and attachment analysis.

I build and tune behavior- and signature-based detections that reduce false positives without sacrificing detection efficacy. My investigations cover process injection, persistence, credential access, AMSI bypass, lateral movement, C2 communication, and identity-based attacks.

I've built a Splunk Enterprise detection lab using Windows Security and Sysmon logs, with SPL detections and dashboards for endpoint visibility. I also write technical research on malware analysis, detection engineering, and adversarial tradecraft.