🔒 Enterprise SOC Home Lab

SIEM Deployment, Threat Detection & Incident Response using Wazuh

Built for the NIS2 era — from architecture to automated threat intelligence.

---

📋 Table of Contents

• Executive Summary
• Architecture
• Environment Specifications
• Project Objectives
• Phase 1: Virtualization Setup
• Phase 2: Ubuntu Server Deployment
• Phase 3: Wazuh SIEM Deployment
• Phase 4: Endpoint Onboarding
• Phase 5: Attack Simulation & Detection
• Phase 6: Incident Investigation
• Phase 7: MITRE ATT&CK Mapping
• Phase 8: Threat Intelligence Integration
• Detection Coverage Matrix
• Skills Demonstrated
• Screenshots & Evidence
• Future Enhancements
• Lessons Learned
• Author

---

🎯 Executive Summary

"I designed a SOC architecture, onboarded endpoints, simulated attacks, investigated alerts, mapped detections to MITRE ATT&CK, integrated threat intelligence, and documented incident response."

This project demonstrates the end-to-end deployment and operation of an enterprise-grade Security Operations Center (SOC) home lab using the Wazuh SIEM platform. The environment was architected to simulate real-world SOC workflows including centralized log collection, endpoint monitoring, security event analysis, threat detection, alert triage, and incident investigation.

Key Achievements:

• 🏗️ Architected and deployed a 4-component Wazuh All-in-One SIEM (Manager, Indexer, Dashboard, Filebeat)
• 📡 Onboarded a Windows 11 endpoint with full telemetry collection
• ⚔️ Simulated 6 distinct attack techniques across the MITRE ATT&CK framework
• 🛡️ Achieved 100% detection coverage for all simulated attacks
• 🔗 Integrated VirusTotal API for automated threat intelligence enrichment
• 📊 Built custom dashboards for security events, MITRE mapping, and compliance monitoring

Relevance to German Market (NIS2 / BSI): This lab directly addresses requirements under NIS2 (EU Directive 2022/2555) and BSI Grundschutz, specifically Article 21 risk management controls, incident detection capabilities, and 24-hour incident reporting workflows.

---

🏗️ Architecture

┌─────────────────────────────────────────────────────────────────────────────┐
│                        Windows 11 Host (Physical)                           │
│  ┌───────────────────────────────────────────────────────────────────────┐  │
│  │              Oracle VirtualBox - Virtualized Infrastructure            │  │
│  │                                                                       │  │
│  │   ┌───────────────────────────────────────────────────────────────┐    │  │
│  │   │              Ubuntu Server 24.04 LTS (Wazuh-Server)          │    │  │
│  │   │  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐         │    │  │
│  │   │  │Wazuh Manager│  │Wazuh Indexer│  │Wazuh Dashboard│       │    │  │
│  │   │  │  (SIEM Core)│  │(Log Storage)│  │(Visualization)│       │    │  │
│  │   │  └──────┬──────┘  └──────┬──────┘  └─────────────┘         │    │  │
│  │   │         │                │                                  │    │  │
│  │   │         └────────────────┴─── Filebeat (Log Shipping)      │    │  │
│  │   └────────────────────────┬────────────────────────────────────┘    │  │
│  │                            │ HTTPS (Port 443)                         │  │
│  │                            ▼                                         │  │
│  │   ┌───────────────────────────────────────────────────────────────┐    │  │
│  │   │              Windows 11 Endpoint (Monitored)                 │    │  │
│  │   │  • Wazuh Agent (Event Collection)                            │    │  │
│  │   │  • Windows Security Events (Auth, Process, Service)            │    │  │
│  │   │  • File Integrity Monitoring (FIM)                           │    │  │
│  │   │  • Sysmon Telemetry (Optional Enhancement)                   │    │  │
│  │   └───────────────────────────────────────────────────────────────┘    │  │
│  │                            │                                         │  │
│  │                            ▼ TCP 1514 (Encrypted)                    │  │
│  └───────────────────────────────────────────────────────────────────────┘  │
│                            │                                                │
│                            ▼                                                │
│              ┌─────────────────────┐                                       │
│              │   VirusTotal API    │  ← Threat Intelligence Enrichment   │
│              │  (Automated IOC     │     (Hash lookup, File reputation)   │
│              │   Enrichment)       │                                       │
│              └─────────────────────┘                                       │
└─────────────────────────────────────────────────────────────────────────────┘

Network Topology: Bridged adapter configuration — the Ubuntu server appears as an independent device on the local network, mirroring enterprise deployments where endpoints communicate directly with centralized security infrastructure.

📁 View Architecture Diagrams: 01-Architecture/

---

⚙️ Environment Specifications

Component	Configuration
Host OS	Windows 11 Pro
Hypervisor	Oracle VirtualBox
SIEM OS	Ubuntu Server 24.04 LTS
SIEM RAM	6 GB
SIEM vCPU	2 Cores
SIEM Storage	60 GB (Dynamically Allocated)
Endpoint OS	Windows 11
Wazuh Version	4.7.5
Network Mode	Bridged Adapter
Communication	TCP Port 1514 (Agent ↔ Manager)

---

🎯 Project Objectives

1. Deploy a centralized, open-source SIEM platform capable of enterprise-scale monitoring
2. Configure secure, encrypted communication between endpoints and the SIEM infrastructure
3. Collect and analyze Windows security events (Authentication, Process Creation, Service Modification, PowerShell Execution)
4. Monitor endpoint activity in real-time from a centralized dashboard
5. Generate actionable security alerts through controlled, ethical attack simulations
6. Investigate detected events using structured SOC methodologies
7. Map all detected activity to the MITRE ATT&CK framework for threat intelligence context
8. Integrate automated threat intelligence enrichment (VirusTotal API)
9. Document complete incident response workflows aligned with NIST SP 800-61

---

Phase 1: Virtualization Setup

Platform: Oracle VirtualBox was selected for its enterprise-grade isolation capabilities, support for 64-bit guest operating systems, and hardware-assisted virtualization features.

Rationale: Virtualization enables logical separation between environments, reduces infrastructure costs, and provides flexibility for future expansion (firewalls, IDS, vulnerable machines).

📁 Details: 02-Wazuh-Deployment/Installation-Guide.md

---

Phase 2: Ubuntu Server Deployment

OS: Ubuntu Server 24.04 LTS — selected for stability, security, low resource consumption, and official Wazuh compatibility.

Hardening Steps:

sudo apt update && sudo apt upgrade -y

• OpenSSH Server enabled for secure remote administration
• Bridged network adapter for direct endpoint communication
• Full system patching applied immediately post-deployment

📁 Details: 02-Wazuh-Deployment/

---

Phase 3: Wazuh SIEM Deployment

Architecture: Wazuh All-in-One (AIO) — ideal for lab environments while maintaining full enterprise functionality.

Installation:

curl -sO https://packages.wazuh.com/4.7/wazuh-install.sh
sudo bash wazuh-install.sh -a

Components Deployed:

Component	Role	Function
Wazuh Manager	Core Engine	Event processing, rule evaluation, alert generation, agent management
Wazuh Indexer	Data Layer	Log storage, indexing, fast search, historical investigation
Wazuh Dashboard	Analyst Interface	Alert investigation, visualization, MITRE mapping, compliance views
Filebeat	Log Shipper	Secure data forwarding between Manager and Indexer

Post-Deployment Verification:

sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

📁 Details & Screenshots: 02-Wazuh-Deployment/

---

Phase 4: Endpoint Onboarding

Agent: Wazuh Agent 4.7.5 deployed on Windows 11 endpoint.

Capabilities Enabled:

• ✅ Security Event Collection (Windows Event Logs)
• ✅ Process Monitoring
• ✅ Authentication Monitoring (Failed/Successful Logons)
• ✅ File Integrity Monitoring (FIM)
• ✅ System Visibility (Registry, Services, Users)

Registration Process:

# On Wazuh Server
sudo /var/ossec/bin/manage_agents -a 192.168.100.32 -n Windows-Victim
sudo /var/ossec/bin/manage_agents -e 001

# On Windows Endpoint (PowerShell as Admin)
cd "C:\Program Files (x86)\ossec-agent"
.\manage_agents.exe -i <AGENT_KEY>

Configuration: Agent configured to communicate via TCP on port 1514 with encrypted traffic.

📁 Details: 03-Agent-Onboarding/Windows-Agent.md

---

Phase 5: Attack Simulation & Detection

Objective: Validate detection capabilities by executing controlled, ethical attacks and verifying alert generation.

Attack Script: A comprehensive PowerShell script was developed to execute 6 attack techniques sequentially, each designed to trigger specific Wazuh detection rules.

Simulated Attacks

#	Attack Technique	Objective	Detection Method
1	Brute Force Authentication	Failed Login Detection	5 failed logon attempts → Rule 60122
2	Malicious Service Creation	Persistence Detection	New Windows service → Rule 61138
3	Registry Modification	Persistence Detection	Run key modification → Windows Event Log
4	PowerShell Abuse	Execution Detection	-ExecutionPolicy Bypass → PowerShell Logging
5	Suspicious Process Execution	Process Monitoring	cmd.exe /c whoami → Process Creation Event
6	Suspicious File Activity	File Monitoring	File creation in TEMP → FIM Alert

📁 Attack Scripts & Documentation: 04-Attack-Simulations/

---

Phase 6: Incident Investigation

Methodology: All incidents were investigated using a structured SOC workflow:

1. Detection → Alert triggered in Wazuh Dashboard
2. Triage → Filter by agent.id and rule.id to isolate events
3. Analysis → Review event details, timestamps, and correlated events
4. Mapping → Align with MITRE ATT&CK techniques
5. Recommendation → Document containment and remediation actions

Incident 001 — Brute Force Authentication

• Severity: Medium
• Rule ID: 60122
• MITRE: T1110 (Brute Force)
• Findings: 5 failed logon attempts targeting Administrator account. No successful authentication.
• Recommendations: Implement MFA, configure account lockout policies, monitor for lateral movement.

Incident 002 — Unauthorized Service Creation

• Severity: High
• Rule ID: 61138
• MITRE: T1543.003 (Create or Modify System Process: Windows Service)
• Findings: Service "MalwareService" created with binary path cmd.exe, configured for auto-start.
• Recommendations: Implement change control, restrict service creation privileges, deploy EDR.

Incident 003 — PowerShell Abuse

• Severity: Medium
• MITRE: T1059.001 (Command and Scripting Interpreter: PowerShell)
• Findings: PowerShell executed with bypassed execution policy. Command simulated malware execution.
• Recommendations: Enable PowerShell script block logging, enforce Constrained Language Mode.

📁 Full Investigation Reports: 05-Incident-Investigations/

---

Phase 7: MITRE ATT&CK Mapping

All detected alerts were automatically mapped to the MITRE ATT&CK framework, providing threat intelligence context and supporting adversary behavior analysis.

Technique ID	Technique Name	Tactic	Detection Status
T1110	Brute Force	Credential Access	✅ Detected
T1543.003	Create/Modify System Process: Windows Service	Persistence	✅ Detected
T1547.001	Registry Run Keys	Persistence	✅ Detected
T1059.001	PowerShell	Execution	✅ Detected
T1059	Command Execution	Execution	✅ Detected
T1105	Ingress Tool Transfer	Command & Control	✅ Detected

Coverage Visualization: The MITRE ATT&CK dashboard in Wazuh displayed active tactics including Defense Evasion, Persistence, Privilege Escalation, Initial Access, and Impact.

📁 Mapping Documentation: 08-MITRE-Mapping/ATTACK-Mapping.md

---

Phase 8: Threat Intelligence Integration

Integration: VirusTotal API connected to Wazuh for automated IOC enrichment.

Workflow:

1. File Integrity Monitoring (FIM) detects a new/modified file
2. Wazuh automatically queries VirusTotal API with the file hash
3. Threat intelligence context (malicious/benign reputation) is appended to the alert
4. Analysts receive enriched alerts with actionable context

Configuration:

<integration>
  <name>virustotal</name>
  <api_key>YOUR_API_KEY_HERE</api_key>
  <group>syscheck</group>
  <alert_format>json</alert_format>
</integration>

Validation: Tested with EICAR anti-malware test file — successfully detected and enriched.

📁 Integration Guide: 07-Threat-Intelligence/VirusTotal-Integration.md

---

📊 Detection Coverage Matrix

MITRE ATT&CK Tactic          │ Coverage │ Detection Method
─────────────────────────────┼──────────┼─────────────────────────────────
Initial Access               │    ⚠️    │ Brute Force (T1110)
Execution                    │    ✅    │ PowerShell (T1059.001), CMD (T1059)
Persistence                  │    ✅    │ Service Creation (T1543.003)
                             │          │ Registry Run Keys (T1547.001)
Defense Evasion              │    ⚠️    │ Execution Policy Bypass
Credential Access            │    ✅    │ Brute Force Detection (T1110)
Discovery                    │    ❌    │ [Planned: BloodHound, Nmap]
Lateral Movement             │    ❌    │ [Planned: Pass-the-Hash]
Command & Control            │    ✅    │ File Activity (T1105)
Exfiltration                 │    ❌    │ [Planned: Data exfiltration rules]
Impact                       │    ❌    │ [Planned: Ransomware simulation]
─────────────────────────────┼──────────┼─────────────────────────────────
Legend: ✅ Detected │ ⚠️ Partial │ ❌ Not Yet Covered

Current Coverage: 6 techniques across 5 tactics. Target: 20+ techniques across all 14 tactics.

---

🛠️ Skills Demonstrated

🔵 SIEM Operations

• Wazuh Administration & Configuration
• Event Correlation & Alert Tuning
• Log Analysis & Parsing
• Dashboard Creation & Customization

🔵 Blue Team / SOC Analyst

• Threat Detection & Alert Triage
• Incident Investigation (NIST SP 800-61)
• Threat Hunting Methodologies
• Endpoint Telemetry Analysis

🔵 Detection Engineering

• MITRE ATT&CK Framework Mapping
• Detection Rule Analysis & Validation
• False Positive Identification
• Coverage Gap Analysis

🔵 Systems & Network Administration

• Ubuntu Linux Server Administration
• Windows Security Configuration
• Virtualization (VirtualBox)
• Network Configuration (Bridged, TCP/IP)

🔵 Threat Intelligence

• VirusTotal API Integration
• IOC Enrichment Workflows
• File Integrity Monitoring
• Automated Threat Context

🔵 Compliance & Frameworks

• NIS2 (EU Directive 2022/2555) — Article 21 Risk Management
• BSI Grundschutz — Baseline security controls
• NIST SP 800-61 — Incident response workflows
• MITRE ATT&CK — Adversary technique mapping

---

📸 Screenshots & Evidence

Evidence	Description
🖥️ Dashboard Login	Wazuh Dashboard successfully deployed and accessible
📡 Active Agent	Windows endpoint successfully enrolled and reporting
📊 Security Events	Real-time event ingestion and visualization
🎯 MITRE Dashboard	ATT&CK technique mapping and coverage view
📋 Compliance View	NIST 800-53 control alignment
⚠️ Brute Force Alert	Failed authentication detection with full context
🔧 Service Creation Alert	Malicious service detection with binary path
📄 Alert Details (JSON)	Raw event data for deep investigation

📁 All Screenshots: Screenshots/

---

🎓 Lessons Learned

1. Detection Rule Validation: Pre-built rules are effective, but validating coverage against real attack techniques is essential. Gaps exist in lateral movement and exfiltration detection.

2. Alert Tuning is Critical: Some alerts generated lower-fidelity events requiring manual investigation. Understanding baseline behavior is necessary for effective tuning.

3. Correlation Multiplies Value: Individual alerts tell a story; correlating events across multiple data sources (endpoint + network + threat intel) provides the full attack narrative.

4. Documentation is a Skill: Structured incident reports with clear timelines, evidence, and recommendations are as important as technical detection capabilities.

5. NIS2 Readiness: German employers under NIS2 need analysts who understand 24h/72h/30d reporting flows. IR playbooks must be designed with these timelines.

---

👤 Author

Alisha Sh

🎯 SOC Analyst | Detection Engineering | Threat Intelligence | NIS2 Compliance

Building defensive capabilities for the NIS2 era. Passionate about blue-team operations, detection engineering, and making security operations measurable and repeatable.

• 🐙 GitHub: github.com/Alisha-sh-dev
• 💼 LinkedIn: linkedin.com/in/alisha-sh/
• 🗣️ Languages: English (C1) | German (B2)

---

_{Built with 💙 and caffeine. One log at a time.
⭐ If this project helped you, consider starring it!}