This project is an educational Security Home Lab created to gain practical experience in:
- Virtual machine deployment and management
- Windows security monitoring
- SIEM implementation
- Endpoint telemetry collection
- Detection engineering
- Threat hunting
- Incident response workflows
The project simulates a small enterprise Blue Team environment where multiple virtual machines generate security telemetry, forward events to a SIEM platform, and support detection development.
The main goal was to understand the complete security monitoring lifecycle:
Virtual Infrastructure
|
v
Endpoint Deployment
|
v
Telemetry Collection
|
v
SIEM Analysis
|
v
Detection Engineering
|
v
Incident Investigation
|
v
Continuous Improvement
During this project, practical experience was gained with:
- Creating and managing virtual machines
- Configuring isolated lab networks
- Working with VM snapshots
- Managing multiple operating systems
- Designing a reproducible security testing environment
Technologies:
- Oracle VirtualBox
- Windows 11 virtual machine
- Ubuntu Server virtual machine
- Kali Linux virtual machine
Experience gained with:
- Windows Event Logs
- Sysmon installation and configuration
- Process monitoring
- Registry monitoring
- Network activity monitoring
- DNS telemetry analysis
Practical experience with:
- Splunk Enterprise deployment
- Splunk Universal Forwarder configuration
- Log ingestion pipelines
- Index management
- SPL query development
- Alert creation
- Dashboard planning
Skills developed:
- Translating security events into detections
- Creating SPL detection logic
- Mapping detections to MITRE ATT&CK
- Validating alerts
- Reducing false positives
- Documenting detection use cases
Windows 11 Endpoint
|
v
Sysmon
|
v
Splunk Universal Forwarder
|
v
Splunk Enterprise
|
v
index=windows
|
v
Detection Rules and Alerts
| VM | Purpose | Main Components |
|---|---|---|
| Windows 11 Endpoint | Endpoint monitoring | Sysmon, Splunk Universal Forwarder |
| Ubuntu Server | SIEM platform | Splunk Enterprise |
| Kali Linux | Security testing | Network and validation tools |
- Installing operating systems in virtual environments
- Configuring VM resources
- Managing storage allocation
- Creating reproducible lab environments
Implemented:
- NAT networking
- Host-only networking
- Internal lab communication
- Static IP planning
Example:
192.168.56.0/24
Splunk Server: 192.168.56.30
Windows Endpoint: 192.168.56.10
Kali Linux: 192.168.56.104
- Creating snapshots before major changes
- Testing configurations safely
- Recovering from configuration issues
- Maintaining an isolated security environment
| Detection | Sysmon Event ID | MITRE ATT&CK | SPL Status | Sigma Status |
|---|---|---|---|---|
| Whoami Execution | 1 | T1033 — System Owner/User Discovery | Validated | Validated |
| Registry Run Key Modification | 13 | T1547.001 — Registry Run Keys / Startup Folder | Validated | Validated |
| PowerShell DNS Query | 22 | T1071.004 — Application Layer Protocol: DNS | Validated | Validated |
| PowerShell Network Connection | 3 | T1071 — Application Layer Protocol | Validated | Validated |
| PowerShell Encoded Command | 1 | T1059.001 — Command and Scripting Interpreter: PowerShell | Validated | Validated |
All five detections are implemented and validated both as SPL searches with scheduled Splunk alerts, and as Sigma rules converted and confirmed against live Splunk data — see sigma/README.md for the validation method.
- Oracle VirtualBox
- Windows 11
- Ubuntu Server
- Kali Linux
- Sysmon
- Splunk Enterprise
- Splunk Universal Forwarder
- MITRE ATT&CK
- Virtual machine deployment
- Network configuration
- Linux and Windows administration
- Security lab design
- Endpoint monitoring
- SIEM operations
- Detection engineering
- Threat hunting
- Incident response
- Live validation of hunting logic against Sysmon telemetry
- Baseline analysis of benign versus controlled network activity
- MITRE ATT&CK mapping
- SPL development
- Security documentation
- Evidence collection
- Lessons Learned
- Project Logbook
- MITRE ATT&CK Mapping
- Detection Use Cases
- Incident Response Workflow
- Threat Hunting Queries
- Security Dashboard Design
- Security Control Matrix
- Project Evidence Index
- GitHub Project Structure
The project validation is separated into three layers:
Endpoint Activity
|
v
Sysmon Telemetry Validation
|
v
Splunk Ingestion and Detection Validation
|
v
Scheduled Alert Validation
- Architecture Evidence
- Installation Evidence
- Sysmon Evidence
- Splunk Evidence
- Alert Evidence
- Threat Hunting Evidence
Completed:
- Virtual infrastructure
- Windows endpoint
- Splunk server
- Sysmon integration
- Universal Forwarder
- Log collection
- Detection rules (SPL)
- Alert validation
- MITRE ATT&CK mapping
- Threat hunting documentation
- Live validation of key threat-hunting queries against Sysmon Event IDs 1, 3, and 13
- Security Overview dashboard query correction and live validation using
Event.System.EventIDafterspath - Incident response workflow
- Validation reports
- Screenshot evidence, including threat-hunting evidence
- Sigma rules for all five validated detections (converted and validated against live Splunk data — see
sigma/README.md) - Phase 2: T1059.001 PowerShell Encoded Command — validated end-to-end with Sysmon Event ID 1, Splunk detection, scheduled alert, evidence capture, and Sigma conversion/live parity validation
Planned, not yet complete:
- Additional Sigma rules beyond the five validated detections (see
sigma/windows/future-rules.md)
The hunting layer and Security Overview dashboard were aligned with the lab's real Sysmon XML field model.
Validated on 2026-09-08:
- Suspicious PowerShell execution hunt — PASS
- PowerShell network hunt — PASS
- Registry persistence hunt — PASS
- Network connection baseline — PASS
- Security Overview detection-relevant activity query — PASS
The working pattern is to run spath first and then extract/filter on Event.System.EventID and Sysmon EventData values. The dashboard no longer relies on the unavailable top-level EventCode field.
Evidence is stored under screenshots/threat-hunting/.
- Additional MITRE ATT&CK techniques
- More Windows attack simulations
- Further Sigma rule development
- Threat intelligence integration
- Automated enrichment
- SOAR workflow simulation
- Additional endpoints
- Active Directory integration
- Enterprise-like network segmentation
This project represents a practical learning journey through:
Virtualization
+
System Administration
+
Security Monitoring
+
SIEM Engineering
+
Detection Development
+
Threat Hunting
+
Incident Response
The final result is a reproducible Blue Team Security Lab demonstrating practical cybersecurity skills.