The lab
A controlled Active Directory network with a web target, a workstation, and a domain controller. Cross-segment traffic crosses an inline Suricata gateway; same-subnet traffic does not.
See the architectureActive Directory attack simulation · Detection engineering · DFIR
One attack.
Twenty stages.
Every gap tracked.
A self-hosted SOC lab where a full adversary campaign runs against an isolated Active Directory network, alerts are triaged, and detection gaps are documented instead of hidden.
20
attack stages
first scan to impact
3
investigation cases
web, lateral, domain
20
detection checks
each mapped to a gap ID
5
documentation layers
lab to final report
01 / The short version
Understand the whole project in one minute.
This is not a folder of notes. It is one traceable story with three layers: the lab, the attack, and the defense.
The campaign
Twenty documented stages take an attacker from reconnaissance to domain compromise and visible impact, with the tooling and evidence plan for each step.
Open the campaignThe defense
Suricata and Wazuh feed a Python bridge into TheHive. Each stage is checked for signal, triaged in a case, and recorded as detected, missed, or unobservable.
Read the detection model02 / The lab
A small network with a real telemetry path.
The attack is local. The detection stack is remote. Nothing from the local lab reaches the cloud without crossing the gateway and the encrypted tunnel.
Design principle
Make the cross-segment detection path unavoidable, then prove what it can and cannot see.
Attack
Kali Linux
192.168.232.135
Adversary workstation and tooling.
Choke point
Suricata gateway
inline inspection
Cross-segment traffic is inspected. Same-subnet lateral movement stays invisible.
Victim network
DVWA192.168.56.30
Windows 10192.168.56.20
Domain Controller192.168.56.10
Each host runs a Wazuh agent for endpoint and log telemetry.
Cloud SOC · VPN
Wazuhprivate cloud VM
thecustomhivehub bridge
TheHiveVPN hub · cases
Wazuh is private; TheHive/automation is the VPN hub and ingress. Alerts become cases with observables, tasks, and a timeline.
Signal path
How one event becomes a case
- 01Traffic
Kali sends attack traffic across the Suricata gateway.
- 02Telemetry
Suricata writes alerts. Wazuh agents ship host and web logs.
- 03Automation
thecustomhive forwards qualifying alerts into TheHive.
- 04Investigation
The analyst scopes, collects evidence, and records a verdict.
Stack
What each layer is for
| Layer | Component | Plain-English job |
|---|---|---|
| Attack | Kali Linux | Runs the adversary tooling. |
| Network | Suricata | Inspects traffic crossing the gateway; same-subnet flows stay local. |
| Ingress | WireGuard | Only 51820/UDP is public; services are VPN or private. |
| Endpoint | Wazuh | Collects host logs and correlates activity. |
| Integration | thecustomhive | Moves alerts from Wazuh into TheHive. |
| Case work | TheHive | Holds the investigation, observables, and tasks. |
| DFIR | Velociraptor | Collects endpoint evidence when needed. |
Detailed setup, IPs, and trust boundaries live in the architecture document.
03 / The campaign
Twenty stages. One connected attack story.
Each card is a chapter. Open one to see what the attacker did, what the defender could see, and what evidence proves it.
Web foothold
Credential access
Domain takeover
Collection and impact
How to read a stage
Read the full attack chain
Every stage answers the same four questions: what happened, what should have been visible, what evidence is required, and what detection gap remains.
04 / The defense
Coverage is measured, not claimed.
A detection only counts when the right telemetry exists and a rule fires for the right reason. Until then, it is a documented gap.
Current status
All 20 checks are intentionally marked Not tested. Evidence is added stage by stage.
20
checks tracked
One for every attack stage, from reconnaissance to impact.
20
gap IDs reserved
DG-01 to DG-20 give every miss a place to live.
3
telemetry layers
Network, endpoint, and identity evidence are checked together.
The rule
A rule that has never fired is a hypothesis, not coverage.
Coverage matrix
Scroll horizontally on small screens
What each stage needs, and what is still missing
| # | Stage | Required telemetry | What to look for | Gap | Status |
|---|
Reading the result: Not tested means the stage has not been validated yet. It is not a pass and it is not a failure.
Open the gap register
Why document misses?
A missed detection is the most useful artifact in the lab. It shows exactly which log source, rule, or field mapping needs work, and it becomes a retest item instead of an untracked weakness.
05 / The investigation
Three cases, one continuous investigation.
The campaign is split into three TheHive cases so the work stays scoped, but the evidence stays connected across all twenty stages.
CASE 01
Stages 01–07
Web application compromise
How a scan became a foothold: brute force, SQL injection, hash cracking, a web shell, a reverse shell, and root.
- Which request first reached the database?
- When did the web server start calling out?
- What proved the attacker reached root?
CASE 02
Stages 08–14
Credential access and lateral movement
How the attacker stayed in, mapped the network, captured credentials, and moved toward the domain.
- Which persistence survived the first cleanup?
- Who answered the victim's name-resolution request?
- Which account unlocked the domain path?
CASE 03
Stages 15–20
Domain compromise and impact
How stolen credentials became domain control, and how the attacker collected, moved, and staged data.
- When did the first forged ticket appear?
- Which account was created for re-entry?
- What left the network, and when?
Analyst workflow
The same six moves for every case
- 01Alert
Identify the signal and its source.
- 02Triage
Decide what is real and how urgent it is.
- 03Scope
Find the first host, account, and timestamp.
- 04Collect
Preserve logs, processes, files, and network evidence.
- 05Verdict
State what happened and what is still unknown.
- 06Report
Turn the evidence into a defensible timeline.
06 / The report
From raw alerts to a defensible narrative.
The report package pulls the campaign, the case work, and the detection gaps into one reviewable incident record.
Report status
Draft
Evidence in progress
The questions
What the report must answer
| Question | Where it is answered |
|---|---|
| What happened, in plain language? | Executive summary |
| Which systems and accounts were affected? | Scope and impact |
| How did the attacker get in and move? | Attack chain |
| What did we detect, and what did we miss? | Detection performance |
| What did we do about it? | Containment and recovery |
| What changes next? | Lessons learned |
Package
Seven documents, one record
- 01Incident reportSummary, scope, analysis, impact
- 02TimelineAttack and response, one clock
- 03IOCsIndicators, confidence, source stage
- 04ATT&CK mappingTechnique, status, evidence
- 05Response actionsContain, eradicate, recover
- 06Lessons learnedGaps, fixes, retest plan
- 07READMEHow the package fits together
01Attack screenshotWhat the attacker did
02Alert screenshotWhat the defender saw
03Case taskWhat the analyst proved
04Report claimWhat the record states
07 / The documents
Start anywhere. The index keeps it connected.
The visual site is the guided tour. The Markdown files are the detailed record and the source of truth.
01
Lab setup
Architecture, network, virtual machines, cloud stack, and the alert bridge.
15 documents 02Attack simulation
Twenty stage write-ups with the attack path, tooling, and evidence convention.
20 stages 03Detection engineering
Coverage matrix, Suricata and Wazuh rules, decoders, and false positives.
8 documents 04Investigation
Stage notes, analyst questions, evidence checklists, and three case summaries.
24 documents 05Incident report
The formal report package: timeline, IOCs, ATT&CK, response, and lessons.
7 documents IDXMaster index
One traceability table linking stage, alert, rule, case, and evidence.
Open the matrix
Plain English
The terms you need, without the jargon.
Suricata
Network detection software. It inspects traffic crossing the gateway and raises an alert when it recognises a suspicious pattern.
Wazuh
The SIEM. It collects logs from hosts, correlates them, and makes alerts searchable in one place.
TheHive
Case management. It turns an alert into a structured investigation with tasks, observables, and a timeline.
Kerberoasting
An attack that requests encrypted service tickets, then cracks them offline to recover a service account password.
DCSync
An attack that impersonates a domain controller to copy password hashes from Active Directory.
Pass-the-Hash
Logging in with a stolen password hash instead of the plaintext password.
Golden Ticket
A forged Kerberos ticket that gives long-lived access to the domain, created with the KRBTGT key.
Detection gap
The telemetry exists, but no rule covers the behavior. A logging gap means the telemetry was never collected.