Building a SOC Lab with Wazuh,Suricata, Sysmon, and DVWA

Introduction

Security Operations Centers (SOCs) rely on Security Information and Event Management (SIEM) platforms to collect, analyze, and correlate security events from different sources. To better understand how modern SOC environments detect threats, I built a home lab consisting of Wazuh, Suricata, Sysmon, Microsoft Defender, and Damn Vulnerable Web Application (DVWA).

The goal of this project was to simulate common cyber attacks, monitor them through a SIEM platform, and map the observed activities to the MITRE ATT&CK framework.

Lab Architecture

The environment consisted of three virtual machines:

• Ubuntu Server (Wazuh Manager) — 192.168.56.101
• Windows 10 Endpoint — 192.168.56.102
• Kali Linux Attacker Machine — 192.168.56.103

The Ubuntu server hosted the Wazuh Manager and dashboard. The Windows endpoint was configured with the Wazuh agent, Sysmon, and Microsoft Defender. Kali Linux was used to perform attack simulations.

Technologies Used

Wazuh

Wazuh served as the primary SIEM platform. It collected logs from different sources, generated alerts, correlated events, and provided centralized visibility into security incidents.

Sysmon

Sysmon was installed on the Windows endpoint to enhance endpoint visibility. It generated detailed logs related to process execution, command-line activity, registry modifications, and other security-relevant events.

Suricata

Suricata functioned as a Network Intrusion Detection System (NIDS). It monitored network traffic and generated alerts when suspicious activity was detected.

DVWA

Damn Vulnerable Web Application (DVWA) was deployed as a deliberately vulnerable application used to simulate web-based attacks in a safe environment.

Microsoft Defender

Microsoft Defender was used to generate malware-related events and validate endpoint detection capabilities through malware simulation testing.

Attack Simulations

1. Nmap Reconnaissance

The first activity involved performing network reconnaissance using Nmap.

nmap -sS -sV -O 192.168.56.102

Suricata detected the scanning activity and generated alerts that were forwarded to Wazuh.

MITRE ATT&CK:

• T1046 — Network Service Discovery

2. Gobuster Directory Enumeration

Directory enumeration was performed against DVWA.

gobuster dir -u http://192.168.56.102/DVWA/ -w /usr/share/wordlists/dirb/common.txt

This generated numerous HTTP requests that could be observed through network monitoring.

MITRE ATT&CK:

• T1595.001 — Active Scanning

3. DVWA Command Injection

A command injection vulnerability was exploited using DVWA.

Input:

127.0.0.1 & whoami

The application executed operating system commands and returned the results to the browser.

MITRE ATT&CK:

• T1203 — Exploitation for Client Execution

4. PowerShell Execution Monitoring

PowerShell activity was executed on the Windows endpoint.

whoami
systeminfo
Get-Process

Sysmon captured the process creation events, which were then forwarded to Wazuh.

MITRE ATT&CK:

• T1059.001 — PowerShell

5. Registry Persistence

Persistence was simulated through Windows Run Keys.

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v EvilTest /t REG_SZ /d "C:\Windows\System32\notepad.exe" /f

Wazuh File Integrity Monitoring successfully detected the registry modification.

MITRE ATT&CK:

• T1547.001 — Registry Run Keys
• T1112 — Modify Registry

6. Malware Simulation

Instead of using real malware, the EICAR test file was used.

Set-Content -Path C:\Users\Public\eicar.com -Value 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'

Microsoft Defender immediately detected and quarantined the file. The resulting events were successfully collected by Wazuh.

MITRE ATT&CK:

• T1204 — User Execution

MITRE ATT&CK Mapping

One of the most valuable features of Wazuh was its integration with the MITRE ATT&CK framework. During testing, alerts were automatically mapped to ATT&CK techniques including:

• T1046 — Network Service Discovery
• T1595.001 — Active Scanning
• T1203 — Exploitation for Client Execution
• T1059.001 — PowerShell
• T1547.001 — Registry Run Keys
• T1112 — Modify Registry
• T1204 — User Execution

This mapping helped provide context around attacker behavior and improved alert analysis.

Key Findings

Several important observations were made during the project:

• Sysmon significantly improved endpoint visibility.
• Registry persistence techniques were easily detected through File Integrity Monitoring.
• Microsoft Defender generated useful telemetry for malware-related events.
• Suricata effectively detected reconnaissance activities.
• Wazuh successfully centralized logs from multiple sources into a single dashboard.

Challenges Encountered

The main challenges involved log tuning, alert correlation, and ensuring that all telemetry sources were properly forwarding events to Wazuh. Troubleshooting data collection pipelines was often more time-consuming than generating the attacks themselves.

Conclusion

This project demonstrated how a modern SOC environment can be built using open-source security tools. By combining Wazuh, Sysmon, Suricata, Microsoft Defender, and DVWA, it was possible to detect and analyze reconnaissance, execution, persistence, and malware-related activities.

The lab provided hands-on experience with SIEM operations, attack detection, threat hunting, and MITRE ATT&CK mapping, making it an effective platform for learning blue-team and SOC concepts.

THIS PROJECT DOCUMENT IS AVAILABLE TO SEE IN MY DRIVE

https://docs.google.com/document/d/1qNoNdQjvXOqYd6EKk5dJFz-i1_gg6l2b/edit?usp=sharing&ouid=101012505105083482465&rtpof=true&sd=true

ASK PERMISSION FOR DOWNLOAD

www.linkedin.com/in/mohammed-rifash-a6484b40b

THANK YOU>>>>>>>