AgrawalSec+Dev.
Cybersecurity engineer & full-stack developer specialising in detection engineering, LLM & MCP security, and secure application development. I build things that are hard to break — and find the breaks in things others build.
RedCell
Security scanner for LLM applications and MCP agents. Adversarial probes mapped to the OWASP LLM Top 10, with live excessive-agency testing against MCP servers and indirect-injection detection that distinguishes a model obeying an injected instruction from merely quoting it. Zero false positives on hardened controls.
11 techniques detected across 8 tactics by Argus's Sigma and correlation rules. 5 more are generated by its attack simulator but not yet detected — the next rules to write.
Reconnaissance
- T1595Active Scanning — not yet detected
Initial Access
- T1566Phishing — detected (Sigma)
- T1190Exploit Public-Facing App — detected (Killchain correlation)
Execution
- T1059.001PowerShell — detected (Sigma)
Persistence
- T1543.003Windows Service — not yet detected
Privilege Escalation
- T1548Abuse Elevation Control — detected (Sigma)
Credential Access
- T1110Brute Force — detected (Sigma)
- T1003.003NTDS — not yet detected
Discovery
- T1046Network Service Discovery — detected (Sigma)
Lateral Movement
- T1021Remote Services — detected (Sigma)
- T1210Exploit Remote Services — not yet detected
Command & Control
- T1071Application Layer Protocol — detected (Sigma)
- T1071.004DNS — detected (Sigma)
- T1090.003Multi-hop Proxy — detected (Killchain correlation)
Exfiltration
- T1048Exfil Over Alt Protocol — detected (Sigma)
Impact
- T1486Data Encrypted for Impact — not yet detected
Let's build
something.
Open to internships, security research, and interesting builds. If it involves breaking things or making them unbreakable — I'm in.