SOC-Home-Lab

The purpose of this project is to host a basic SOC environment locally.

This project contains the steps to configure a SOC environment locally on your home computer using Virtual Machines and some basic networking concepts. We will make use of the following services:

1. Virtualbox along with Virtual machines Including Ubuntu, Windows-10, Kali-Linux
2. Wazuh Siem
3. Shuffle
4. Mimikatz (Malware)
5. Sysmon (For Windows)
6. VirusTotal
7. Discord
8. Hydra (Script in Kali)

In summary, we will achieve the following:

A. Phase 1:

1. Detect threats on our Windows virtual machine with Wazuh SIEM
2. Forwarding the detected threat to shuffle for enrichment
3. Automatically forwarding an alert message to a Discord server for specific threats

B. Phase 2:

1. Detecting threats on our Ubuntu virtual machine with Wazuh SIEM
2. Simulating a SSH brurte force attack on our Ubuntu machine using a Kali Virtual machine as our attackbox
3. Mitigating the adversity of the SSH brute force attack using "active response" capability of Wazuh SIEM

Windows VM

1. We Installed Mimikatz on the Windows VM and a Wazuh Agent
2. We Configured Sysmon to send Logs to the Wazuh SIEM

Ubuntu VM

1. We Configured Ubuntu VM to install the Wazuh Dashboard and detect specific alerts from Windows.
2. We also got logs of our SSH brute force from our victim Ubuntu Machine
3. We also configured the Wazuh Configuration file to include a new Active Response Rule

Shuffle

1. This is our Shuffle Workflow
2. This Includes Alerts From Wazuh > Regex > VirusTotal > Discord

Kali Attacker Machine

Discord

1. This is what Discord will Display upon recieving the message from shuffle