{ Security-in-bits }
SubscribeSearch

Ayush Anand

Detection engineer and malware analyst. 15+ years defending against malware: reverse engineering at Symantec, then leading malware defense and incident response at a global bank. Now I build detections in my own lab and teach them in public, one bit at a time.

Get the newsletterBrowse the detection index

Now

Writing and teaching

I write the Security in Bits newsletter and run a YouTube channel covering detection engineering, RMM abuse, and ransomware techniques. I turn lab investigations into practical walkthroughs: how the technique works, what evidence it leaves, and how defenders can hunt for it. The newsletter carries the detailed analysis and queries; YouTube shows the investigations and detections in action.

Building and testing in the lab

I run an instrumented home lab with Microsoft Defender for Endpoint, Elastic Security, Velociraptor, Suricata, and Sysmon. I reproduce attacker techniques, collect endpoint and network evidence, and use that telemetry to develop and test detections. My current focus is RMM abuse and the activity leading up to ransomware encryption, including what the tools detect, what they miss, and why.

Read the newsletterWatch on YouTubeExplore detections

Track record

Experience

  1. 2018–present

    Founder

    Security-in-bits

    Detection engineering and malware analysis, written up from my own lab.

  2. 2017–present

    Senior Vice President, Cyber Defense Senior Manager

    A global bank

    Lead a multi-region team defending against malware and phishing; incident bridge lead for malware events, from containment to eradication.

  3. 2011–2017

    Senior Malware Analyst

    Symantec, Security Technology and Response (STAR), Singapore and Pune

    Targeted-attack malware analysis, YARA and IPS signatures, published threat research.

Education

Bachelor of Engineering, Computer
University of Pune · 2005–2009

Certifications (6)

Patents

3 granted · 2 published applications

Publications (4)

Since 2018: every post on this site and the newsletter.

Courses and training (9)

Contact

Email contact@securityinbits.com. DMs on X and LinkedIn are fine too, and often faster. Corrections are welcome and acted on.

Last reviewed .

Get the next detection in your inbox

One lab-proven detection per issue: the attacker command, the telemetry it leaves, and the KQL / ES|QL that catches it.

You confirm on Substack in one tap.

No spam. Unsubscribe anytime.