SOC Detection & Telemetry Home Lab
A dedicated virtualized SOC engineering environment with Windows 11 endpoints, Sysmon, Splunk Enterprise, and Atomic Red Team for detection rule testing.
The Problem
Effective SOC detection depends on realistic operating system telemetry: generating it, forwarding it and querying it under simulated attack conditions.
Project Context
Built an on-premise virtualized testing lab using Hyper-V and Docker to safely emulate adversary techniques, evaluate detection fidelity, and author custom alert logic.
System Architecture & Data Flow
The architecture routes endpoint and network telemetry through a centralized pipeline into Splunk Enterprise for real-time alerting and hunting.
Windows 11 Workstation + Ubuntu Server endpoints run isolated on an internal virtual switch.
Sysmon v15 deployed on Windows with SwiftOnSecurity configuration capturing process execution, network sockets, and file integrity events.
Splunk Universal Forwarder ingests Windows Event Logs, Sysmon, and Linux journald/auth logs via TLS 1.3.
Central Splunk Indexer normalizes events according to Common Information Model (CIM) standards.
Custom SPL correlation searches trigger alerts mapped directly to MITRE ATT&CK techniques.
Adversary simulation executed via Atomic Red Team and PowerShell scripts in a controlled sandbox.
Technologies & Tools Used
Security Considerations
- •Lab VMs run on an isolated private vSwitch with default egress disabled to prevent outbound malware propagation.
- •Atomic test commands are vetted before execution to ensure they only execute non-destructive diagnostic actions.
- •Splunk forwarder communications use mutual TLS certificates to protect telemetry in transit.
- •Snapshots taken before each simulation run to allow immediate rollback to a known pristine baseline.
Implementation Notes
• Tuning the Sysmon configuration to suppress noisy background events (for example OneDrive sync and Defender signature updates) while keeping security-relevant telemetry.
• Writing detection rules for encoded PowerShell execution, LSASS memory access, and suspicious scheduled task creation.
• Designing a Splunk analyst dashboard for failed logons, process anomalies, and connections to non-standard ports.
Engineering Challenges
Results
- Provides the environment used for the training labs documented on this site.
Key Takeaways
- •High-quality logging configuration (like Sysmon) is more critical for threat detection than raw log volume.
- •Parent-child process relationship analysis catches obfuscated attacks that evade simple string-matching rules.