---
title: "Tirthak Likhar (@tirthak10) | Hashnode"
description: "I build SOC labs, break things deliberately, and write about what I find. Read the latest articles by Tirthak Likhar on Hashnode."
url: "https://hashnode.com/@tirthak10"
---

@tirthak10

# Tirthak Likhar

@tirthak10 · Pune, India · Joined April 2026

I build SOC labs, break things deliberately, and write about what I find.

[Website](https://www.tirthaklikhar.com/)

### [What EDR Reveals After a Suspicious Document Opens](https://tirthaklikhar.hashnode.dev/what-edr-reveals-after-a-suspicious-document-opens?utm_source=hashnode&utm_medium=feed)

Follow the evidence from the first alert to the downloaded file, and learn how EDR helps determine what ran, what stopped, and what remains uncertain.

6 min read · [tirthaklikhar.hashnode.dev](https://tirthaklikhar.hashnode.dev/what-edr-reveals-after-a-suspicious-document-opens?utm_source=hashnode&utm_medium=feed)

[Sep 28](https://hashnode.com/posts/what-edr-reveals-after-a-suspicious-document-opens/6aba964e5f1a504879cedaf6)

### [Climbing the Pyramid of Pain: From Hashes to TTP-Based Detection](https://tirthaklikhar.hashnode.dev/climbing-the-pyramid-of-pain-from-hashes-to-ttp-based-detection?utm_source=hashnode&utm_medium=feed)

What TryHackMe Summit teaches beginner SOC analysts about building detections attackers cannot easily evade

22 min read · [tirthaklikhar.hashnode.dev](https://tirthaklikhar.hashnode.dev/climbing-the-pyramid-of-pain-from-hashes-to-ttp-based-detection?utm_source=hashnode&utm_medium=feed)

[Sep 11](https://hashnode.com/posts/climbing-the-pyramid-of-pain-from-hashes-to-ttp-based-detection/6aa4219dfef57149febae21c)

### [SOC Team Internals: How an L1 Analyst Thinks, Triages and Reports](https://tirthaklikhar.hashnode.dev/soc-team-internals-everything-an-l1-analyst-needs-to-know?utm_source=hashnode&utm_medium=feed)

Everything an L1 SOC analyst needs: alert triage, Five Ws reporting, workbooks, MTTD, MTTA, MTTR and FPR explained.

12 min read · [tirthaklikhar.hashnode.dev](https://tirthaklikhar.hashnode.dev/soc-team-internals-everything-an-l1-analyst-needs-to-know?utm_source=hashnode&utm_medium=feed)

[May 31](https://hashnode.com/posts/soc-team-internals-everything-an-l1-analyst-needs-to-know/6a1c6317151e62857d90d0a1)

### [Why the OSI Model Diagram in Your Textbook Is Incomplete](https://tirthaklikhar.hashnode.dev/why-the-osi-model-diagram-in-your-textbook-is-incomplete?utm_source=hashnode&utm_medium=feed)

The OSI diagram in your textbook is incomplete. Walk a PDF through all 7 layers and finally understand how networks work.

9 min read · [tirthaklikhar.hashnode.dev](https://tirthaklikhar.hashnode.dev/why-the-osi-model-diagram-in-your-textbook-is-incomplete?utm_source=hashnode&utm_medium=feed)

[May 25](https://hashnode.com/posts/why-the-osi-model-diagram-in-your-textbook-is-incomplete/6a1426f67d85e6a1afc25a46)

### [TryHackMe SEC1 Certification: A Honest, Detailed Review](https://tirthaklikhar.hashnode.dev/tryhackme-sec1-certification-a-honest-detailed-review?utm_source=hashnode&utm_medium=feed)

Passed TryHackMe SEC1 on the first attempt. Here is what the exam tests, where it is hard, and whether it belongs in your certification plan.

11 min read · [tirthaklikhar.hashnode.dev](https://tirthaklikhar.hashnode.dev/tryhackme-sec1-certification-a-honest-detailed-review?utm_source=hashnode&utm_medium=feed)

[May 7](https://hashnode.com/posts/tryhackme-sec1-certification-a-honest-detailed-review/69fcc1ae9f93a850a4ef417e)