A home SOC lab built to develop, validate, and document endpoint and network detections using Wazuh, Sysmon, Suricata, Atomic Red Team, and Shuffle SOAR.
The purpose of this project is not simply to deploy security tools, but to understand how telemetry is generated, how detection rules are written and validated, how alerts are investigated, and how enrichment workflows improve analyst efficiency.
All detections included in this repository were tested inside an isolated virtual lab and are documented with their implementation, testing methodology, investigation process, observations, and known limitations.
Additional architecture details are available in:
| Component | Purpose |
|---|---|
| Wazuh Manager | Central log collection, detection engine, and alert management |
| Windows 11 Endpoint | Generates endpoint telemetry through Sysmon and Windows Security logs |
| Sysmon | High-fidelity endpoint event collection |
| Atomic Red Team | Attack simulation and detection validation |
| Suricata IDS | Network intrusion detection |
| Shuffle SOAR | Automated enrichment workflow |
| VirusTotal | IP reputation enrichment |
| VirtualBox | Virtual lab environment |
This repository focuses on four areas of detection engineering:
- Building detections using real endpoint and network telemetry
- Validating detections through controlled attack simulations
- Documenting investigation procedures using analyst playbooks
- Automating repetitive analyst tasks with SOAR
Rather than demonstrating tool installation alone, the lab emphasizes understanding how security events move through the detection pipeline—from telemetry generation to investigation.
| ATT&CK Tactic | Technique | Detection |
|---|---|---|
| Credential Access | T1003.001 | LSASS Process Access |
| Execution | T1059.001 | PowerShell EncodedCommand |
| Persistence | T1136.001 | Local Administrator Account Creation |
| Discovery | T1046 | Network Service Discovery |
| Credential Access | T1110.001 | SSH Brute Force Detection |
Attack Simulation
│
▼
Windows / Network Telemetry
│
▼
Wazuh Agent
│
▼
Wazuh Manager
│
▼
Custom Detection Rules
│
▼
Alert Generation
│
▼
Analyst Investigation
│
▼
SOAR Enrichment
│
▼
Threat Intelligence Context
- Sysmon telemetry collection
- Windows Security log monitoring
- Custom Wazuh detection rules
- MITRE ATT&CK mapping
- Atomic Red Team validation
- Suricata IDS integration
- SSH brute force detection
- Network scan detection
- Packet inspection through
eve.json
- Detection-specific playbooks
- Evidence collection
- Timeline analysis
- Triage guidance
- False positive considerations
- Shuffle Cloud integration
- Automatic VirusTotal IP enrichment
- Webhook-based workflow execution
- Analyst enrichment output
| Rule ID | Detection | ATT&CK | Log Source |
|---|---|---|---|
| 100100 | LSASS Process Access | T1003.001 | Sysmon Event ID 10 |
| 100101 | PowerShell EncodedCommand | T1059.001 | Sysmon Event ID 1 |
| 100102 | Local Administrator Added | T1136.001 | Windows Security Event ID 4732 |
Detailed documentation for each rule is available inside the detections directory.
Every detection included in this repository was validated using controlled testing.
Validation methods include:
- Atomic Red Team
- Native Windows commands
- PowerShell simulations
- Nmap
- SSH brute force testing
Each detection document contains:
- Detection logic
- Testing methodology
- Alert evidence
- Investigation notes
- Known limitations
- False positive considerations
This repository includes analyst playbooks describing how alerts should be investigated after they are generated.
Each playbook contains:
- Trigger condition
- Investigation workflow
- Timeline analysis
- Evidence collection
- Triage decision
- Recommended response
- False positive guidance
Current playbooks include:
- LSASS Credential Dumping
- PowerShell EncodedCommand
- Local Administrator Account Creation
- Network Scan and SSH Brute Force
The lab integrates Wazuh with Shuffle Cloud through webhook integrations.
When Wazuh generates an alert meeting the configured threshold:
- Wazuh sends the alert to Shuffle.
- Shuffle extracts the endpoint IP.
- VirusTotal is queried automatically.
- Reputation data is returned.
- The analyst receives enriched context without leaving the investigation workflow.
The workflow documentation includes:
- Workflow design
- Node configuration
- Variable mapping
- Execution evidence
- Lessons learned
.
├── architecture/
├── detections/
├── playbooks/
├── screenshots/
├── soar/
├── setup/
└── README.md
| Category | Technologies |
|---|---|
| Operating Systems | Windows 11 Enterprise Evaluation, Ubuntu Server 22.04, Kali Linux |
| Detection Platform | Wazuh 4.12 |
| Endpoint Telemetry | Sysmon (SwiftOnSecurity configuration) |
| Network IDS | Suricata |
| Attack Simulation | Atomic Red Team, PowerShell, Nmap |
| SOAR | Shuffle Cloud |
| Threat Intelligence | VirusTotal |
| Virtualization | Oracle VirtualBox |
| Machine | Role | Address |
|---|---|---|
| Ubuntu Server | Wazuh Manager + Suricata | 192.168.100.10 |
| Windows 11 | Monitored Endpoint | 192.168.100.20 |
| Kali Linux | Attack Machine | 192.168.100.30 |
The virtual machines communicate through an isolated internal network while maintaining Internet access through a separate NAT adapter for updates and software installation.
Detailed documentation is available in the following files:
| Document | Description |
|---|---|
| Setup Guide | Environment setup and installation |
| Architecture | Lab architecture and telemetry flow |
| Detection Rules | Custom detection rule documentation |
| Playbooks | Investigation and response playbooks |
| Category | Location |
|---|---|
| Detection Rules |  |
| Wazuh Alert | |
| Network Detection |  |
| SOAR Workflow |  |
Screenshots throughout the repository demonstrate rule creation, alert generation, investigation evidence, workflow execution, and enrichment results.
This project is designed as a learning and validation environment rather than a production SOC deployment.
Current limitations include:
- Single monitored Windows endpoint
- Single Wazuh manager
- No centralized authentication
- Limited attack coverage
- No high-availability deployment
- No large-scale telemetry volume
- Cloud-based Shuffle deployment instead of self-hosted infrastructure
These limitations are documented where they affect individual detections or workflows.
- Wazuh Documentation
- Microsoft Sysmon Documentation
- SwiftOnSecurity Sysmon Configuration
- Atomic Red Team
- MITRE ATT&CK Framework
- Suricata Documentation
- Shuffle Documentation
- VirusTotal API Documentation
This lab builds upon the work of the following open-source projects:
- Wazuh
- Sysmon
- SwiftOnSecurity Sysmon Configuration
- Atomic Red Team
- Suricata
- Shuffle
- VirusTotal
- MITRE ATT&CK
Their documentation and tooling made it possible to validate detections in a controlled lab environment.
This repository demonstrates the complete lifecycle of a detection:
Attack Simulation
│
▼
Telemetry Collection
│
▼
Detection Development
│
▼
Rule Validation
│
▼
Alert Investigation
│
▼
Threat Intelligence Enrichment
│
▼
Documentation
Rather than presenting detections alone, the repository documents the engineering process used to develop, validate, investigate, and automate them.
This repository is intended for educational purposes.
Use all attack simulations only inside systems you own or are explicitly authorized to test.