Enterprise SIEM Detection Lab: Wazuh + Sysmon + MITRE ATT&CK

A home SOC lab that ingests Windows and Linux endpoint telemetry into Wazuh, maps custom detections to MITRE ATT&CK, and validates every one of them by actually running the attack technique and confirming a real alert fires.

Architecture

                          ┌─────────────────────────┐
                          │   Wazuh Dashboard :443   │
                          └────────────┬─────────────┘
                                       │
                          ┌────────────▼─────────────┐
                          │   Wazuh Indexer  :9200    │
                          └────────────▲─────────────┘
                                       │
                          ┌────────────┴─────────────┐
                          │   Wazuh Manager :1514/15  │
                          │   + custom local_rules.xml│
                          └───▲───────────────────▲───┘
                              │                    │
                 Sysmon events│                    │auditd events
                    (eventchannel)                 │(exec/file watch)
                     ┌────────┴───────┐   ┌─────────┴────────┐
                     │ Windows Agent  │   │  Linux Agent      │
                     │ + Sysmon       │   │  + auditd         │
                     └────────────────┘   └───────────────────┘

Repository layout

wazuh-siem-lab/
├── docker/                     Wazuh manager + indexer + dashboard (Docker Compose)
├── sysmon/sysmonconfig.xml     Sysmon config tuned to this lab's target techniques
├── wazuh-rules/local_rules.xml 22 custom detection rules, MITRE-tagged
├── sigma-rules/                Portable Sigma equivalents of key rules
├── atomic-tests/
│   ├── coverage-matrix.csv     Technique -> rule -> result, with full diagnostic notes
│   └── RUNBOOK.md              How to run the tests
├── docs/endpoint-onboarding.md How to enroll Windows/Linux agents
└── screenshots/                Real alert screenshots

Quick start

cd docker && docker compose up -d
# enroll agents: see docs/endpoint-onboarding.md
# run tests: see atomic-tests/RUNBOOK.md

Results

20/20 techniques confirmed DETECTED (100%), live-tested against a real Wazuh manager/indexer/dashboard stack with a Windows Server 2022 agent (Sysmon) and an Ubuntu agent (auditd), not estimated.

Getting there involved finding and fixing several real bugs: Sysmon silently dropping events for binaries missing from its include filter, a Sysmon exclude-rule logic flaw that erased an entire detection category, custom rules losing silent precedence fights against Wazuh's own built-in rules, and one case where Windows Defender had already blocked an attack before Sysmon could see it. The full story for every technique, what broke, why, and how it was fixed, is in atomic-tests/coverage-matrix.csv.

Screenshots

Captured from the live dashboard against real alerts, nothing staged.

MITRE ATT&CK coverage

Tactic	Techniques covered
Execution	T1059, T1059.001
Persistence	T1053.005, T1547.001, T1547.004, T1136.001
Privilege Escalation	T1053.005, T1055
Defense Evasion	T1218.005, T1218.010, T1027, T1070.001, T1562.001
Credential Access	T1003.001, T1003.002, T1003.008
Lateral Movement	T1021.002, T1021.006, T1047
Command & Control	T1071.001
Linux Persistence / Defense Evasion	T1053.003, T1070.003

Safety notes

• Run attack simulation only in an isolated, snapshot-able lab (VirtualBox/VMware on a host-only or NAT network). Never point it at a production machine.
• Credentials in docker/.env.example are placeholders; generate real secrets before deploying, and never commit a populated .env file.
• TLS certificates are generated locally and excluded from version control.

License

MIT. See LICENSE.