DFIR · SOC · Threat Hunting · AI-Augmented IR

Dhiren
Bhardwaj

11+ years of Digital Forensics & Incident Response across AT&T, Kotak Mahindra Bank, Microsoft and Deloitte — from raw disk images to global cloud incidents. Now building the tools that let AI carry the repetitive weight of the SOC.

Establish connection View arsenal ↓

BASE Jaipur, IN CURRENT Senior DFIR Analyst @ AT&T CLEARANCE EnCE · M.S. Digital Forensics

guest@dfir — interactive
This terminal is real. Type help or tap a command below.
guest@dfir:~$

0+

Years DFIR & SOC

0

Orgs · BFSI → BigTech

0%

SLA gain @ Microsoft

0

AI security tools built

01 / whoami

Evidence first.
Everything else follows.

I've run investigations from raw disk images in a forensics lab to global cloud incident response at Microsoft to L3/L4 insider-threat cases inside a regulated bank — and now lead DFIR at AT&T: phishing, malware outbreaks, unauthorized access, suspicious network activity, with chain of custody intact.

The through-line is end-to-end ownership: detection → triage → containment → forensics → root cause → the uncomfortable meeting with leadership → the runbook that makes sure it never takes that long again.

Current obsession: AI-augmented incident response. Four working tools below — LLM-driven email triage, malware intelligence notes, memory-forensics analysis and an agent-callable investigation lab — because the future SOC has an AI analyst on shift, and someone with 11 years of incident scars should be the one training it.

I write about the field at Digital Forensic Forest.

02 / career.log --reverse

Eleven years of
incident bridges.

Senior DFIR Analyst

MAR 2026 — PRESENT

AT&T · Hyderabad

  • Lead DFIR investigations across phishing, malware outbreaks, insider threats, unauthorized access and suspicious network activity.
  • Coordinate end-to-end incident management — investigation, containment, eradication, recovery, post-incident analysis.
  • Forensics across endpoints, servers, memory artifacts and cloud environments with chain-of-custody discipline.

Deputy Vice President — SOC & IR Lead

FEB 2024 — FEB 2026

Kotak Mahindra Bank · Mumbai

  • Led L2/L3 SOC investigations — phishing, insider threat, malware, endpoint anomalies — in a regulated banking environment.
  • Forensics across email compromise and insider misuse; escalated high-severity incidents to leadership with clear impact and remediation.
  • Authored IR runbooks, ran tabletop exercises, mentored SOC analysts; aligned ops with NIST CSF & MITRE ATT&CK.

Security Engineer II — Global Security Operations

JAN 2022 — JAN 2024

Microsoft · Hyderabad

  • Global IR coordination on Sentinel, Defender, MCAS and O365.
  • Shipped IR automation → 25% SLA improvement; automated workflows cutting manual effort by 50%.
  • KQL-driven investigations correlating events and threat intel across cloud and enterprise estates.

Assistant Manager — Digital Forensics & Cyber Investigations

NOV 2017 — JAN 2022

Deloitte · Gurgaon

  • Forensic engagements for enterprise & financial-services clients: memory forensics, endpoint investigation, email analysis, log correlation.
  • Built ELK-based log analysis platforms for threat visibility and hunting; presented findings to client leadership.

Digital Forensic Analyst

FEB 2016 — OCT 2017

Mahindra Special Services Group · Mumbai

  • Cyber fraud & insider threat investigations — artifact analysis, email headers, user activity reconstruction; evidence handling with legal & compliance.

Digital Forensic Analyst

JUL 2014 — FEB 2016

eSF Labs · Hyderabad

  • Forensic imaging, RAM dump analysis, malware & web-attack investigations, Android/mobile forensics; wrote lab automation scripts.

03 / ls ~/arsenal

The AI security
arsenal.

Open-source and personal R&D — every tool exists because a repetitive SOC/DFIR task annoyed me enough to automate it.

Flagship · AI Agents × DFIRCompleted · Release pending

AI-Native DFIR Investigation Lab — MCP Server

A SOC-in-a-box: a simulated enterprise security environment plus a Model Context Protocol (MCP) server that lets an AI agent run real investigations against it — the architecture pattern behind next-generation AI-assisted SOC tooling.

  • Simulated SIEM in SQLite — sign-in logs, user directory, incidents, alerts and IP threat-intel tables mirroring Azure AD / Sentinel / Defender schemas.
  • Five seeded attack scenarios: AiTM impossible travel (T1078), password spray (T1110.003), brute force (T1110.001), suspicious app access (T1528) + clean baselines.
  • Seven agent-callable investigation tools — investigate_user, enrich_ip, hunt_suspicious, incident & alert queries — the AI plans the investigation, calls tools, writes the report.
  • Doubles as a DFIR training range for analysts, with verdicts and MITRE technique mapping built in.
PythonMCPSQLiteMITRE ATT&CKAI Agents

// source publishing soon — walkthrough on request

SOC AutomationOpen source

AI-SOC Email Triage & Forensics

Turns suspicious-email triage — the SOC's highest-volume grunt work — into a safe, repeatable, AI-assisted pipeline.

  • Parses .eml files: headers, bodies, attachments → structured JSON for case documentation.
  • Attachments stored Base64 — never executed; forensically safe by design.
  • Gemini analysis flags phishing lures, impersonation and header anomalies.
PythonGeminiEmail ForensicsPhishing

[ source on GitHub ↗ ]

Malware IntelligenceOpen source

MalNote — Intelligent Malware Note Generator

Automated malware triage: one file in, a complete intelligence-enriched DFIR note out.

  • SHA-256 hashing + local ClamAV scan, then correlation across VirusTotal, AlienVault OTX, ThreatFox & MalwareBazaar.
  • Auto-generates a Markdown analysis note ready for case files.
  • Optional Gemini AI layer summarises findings and recommends next DFIR actions.
PythonClamAVVirusTotalThreat IntelGemini

[ source on GitHub ↗ ]

Memory ForensicsOpen source

Volatility Output Analysis using AI

Memory forensics produces walls of process listings and handles — this pipes Volatility framework output through AI analysis so the anomalies surface themselves.

  • Takes raw RAM-analysis output from Volatility and applies LLM reasoning to highlight suspicious processes and artifacts.
  • Compresses hours of manual memory-dump review into a guided starting point for the examiner.
PythonVolatilityRAM ForensicsAI

[ source on GitHub ↗ ]

Writing · CommunityLive

Digital Forensic Forest

Long-running blog on digital forensics and incident response — investigation techniques, tooling notes and lessons from more than a decade in the field.

DFIRForensicsField Notes

[ read the blog ↗ ]

04 / cat skills.conf

Proficiency earned in
production incidents.

incident_response

End-to-end DFIRThreat HuntingMalware AnalysisBreach InvestigationRoot Cause AnalysisInsider ThreatThreat Intelligence

siem_detection

Microsoft SentinelKQLSplunkELKDefender / MCASEDR / XDRSigmaNetwork Traffic Analysis

forensics_toolchain

EnCaseVolatilityFTKMagnet AxiomCellebriteOxygenX-WaysSIFTRedlineIntella

frameworks

MITRE ATT&CKCyber Kill ChainNIST CSFNIST IR LifecyclePurple TeamingForensic Readiness

cloud_platform

AzureO365AWSWindowsLinuxActive DirectoryCloud Forensics

automation_ai

PythonAI-Augmented IRKQLPowerShellLLM EnrichmentMCP Agent ToolingTriage Automation

05 / credentials.db

Papers, verified.

M.S. — Digital Forensics & Information Assurance

Gujarat Forensic Sciences University

2012–14

B.Tech — Computer Science

Poornima College of Engineering

2006–10

EnCase Certified Examiner (EnCE)

OpenText / Guidance Software

2020–23

Azure Fundamentals (AZ-900)

Microsoft

2023

Security, Compliance & Identity (SC-900)

Microsoft

2023

ACE + Intella Basic & Advanced

AccessData · Vound Software

—

06 / man dhiren

Frequently asked.

Who is Dhiren Bhardwaj?

A Digital Forensics & Incident Response (DFIR) and SOC leader from India with 11+ years of experience — currently Senior DFIR Analyst at AT&T; previously Deputy Vice President (SOC & IR Lead) at Kotak Mahindra Bank, Security Engineer II at Microsoft Global Security Operations, and Assistant Manager for Digital Forensics at Deloitte. M.S. in Digital Forensics (GFSU), EnCase Certified Examiner.

What does he specialise in?

End-to-end DFIR — disk, memory, mobile and email forensics; cloud incident response on Azure/O365; SOC strategy and L2–L4 investigations; threat hunting with KQL, Sentinel, Splunk and ELK; insider-threat cases in regulated banking; and AI-augmented incident response, where he builds open-source LLM tooling for SOC teams.

What AI security tools has he built?

Four working tools: AI-SOC Email Triage (.eml → JSON → Gemini phishing analysis), MalNote (automated malware notes from ClamAV + VirusTotal + OTX + ThreatFox + MalwareBazaar + Gemini), Volatility Output Analysis using AI (LLM-assisted memory forensics), and an AI-Native DFIR Investigation Lab (MCP server + simulated SIEM with agent-callable investigation tools). Code: github.com/dhirenbhardwaj.

How to reach him?

Email dhiren102@gmail.com · LinkedIn linkedin.com/in/dhirenbhardwaj · GitHub github.com/dhirenbhardwaj. Open to DFIR leadership, IR transformation and purple-teaming engagements.

Establish connection.

DFIR leadership · IR transformation · cloud-native security · purple teaming strategy. Response time under 24 hours.

Emaildhiren102@gmail.com LinkedIn/in/dhirenbhardwaj GitHub/dhirenbhardwaj Blogdigitalforensicforest