Project: SOC Automation Home Lab-1

Before we begin, please make sure you read the previous article so you know what you’re doing.

Another thumbnail filler

If you’re intending to use Windows 11, please ensure you have a Microsoft account ready since Windows 11 forces you to sign in before completing setup. I would recommend an account specially for VM environments.

LAB 1 — Configuring and Installing a Windows Virtual Machine with Sysmon

1. Installing Virtualbox and Windows 11

• Open the virtualbox website and install the latest version. If the latest version doesn’t work, go to the downloads page and and scroll down, you should see a section where you can download older builds. Then simply install it.

• Download Windows 11 from Microsoft’s website and wait for it to finish
• Open up your Virtual Box software and click on New

• Name your VM as you see fit. I would suggest something pertaining to the project at hand. I’ve named mine **VMClient
• **In the iso image field, click on drop down arrow on the left and click on the browse button.
• Select the iso image we downloaded previously - Ensure you have unattended installation option unchecked

The yellow box with the green arrow is the browse option btw

Ensure you have the OS Version set to Windows 11 (64-bit)

• Click on “Specify virtual hardware” and allocate a minimum of 8GB of memory, a minimum of 2 cores and a minimum of 4GB of memory and a minimum of 2 cores; for Windows 11 and Windows 10 respectively.
• Also ensure you have Use EFI selected

• Then click on “specify virtual hard disk” and allocate a minimum of 80GB for Windows 11 and 50GB for Windows 10.

• Then click on finish and your VM should be ready
• Power-up your Windows VM and follow the images below

Click on I don’t have a product key

Possible Issues

• Sometimes things aren’t straight forward. Sometimes you get this screen. No need to panic. I gotchu 😎

Boot Screen Error

• In order to fix this issue click on the drop-down on the right hand side and click on your windows ISO
• Then click on mount and retry boot. It should work
• If in case it doesn’t, you can manually mount your iso into the VM through the Devices tab. Click on it and then click on Optical Drives and then your Windows iso file

• Then you can reset the machine through the Machine tab

-

• The next time your VM reloads it should begin the setup process. If not, it should show “Press any key to boot from CD or DVD”. Press the spacebar when it appears to begin the setup process
• Sometimes you get an error like this. I want to blame Microsoft but unfortunately this is a VM config issue. I have no idea why this comes up but a fix is to delete this VM and ensure that in your next installation you enable EFI and ensure that you select Windows 10 (64-bit) or Windows 11 (64-bit) [depending on your iso file] in your OS version during setup

After you install your windows VM, you might require a Windows license activate your OS to fully realize your Home Lab. Please do not use sites like massgrave to activate your Windows. I do not condone piracy of any kind and all information is for educative purposes only.

If you ever feel like your window screen is too small, click on this icon

The VM screen should re adjust.

If you still feel like its too small, click on Devices and then Insert Guest Additions CD image

This should mount a CD drive in your VM. Click on file explorer and install the application.

Click yes on all prompts.

Right click on the screen and open display settings. Find the Scale option and crank it to the max, et voila!

You can maximize your VM screen to fullscreen for ease of use

Finally I can see shi

2. Installing sysmon on your Windows VM

• Open the browser in your VM and search for sysmon. The first result should be from Microsoft. Download and extract it.

• The search for **Sysmon Config Olaf Github** for the configuration files
• Scroll all the way to the bottom until you find a file called sysmonconfig.xml - Click on it and select the raw option

• This should render the code in unformatted plain text.
• Right click on the screen and save the file (in XML format obv)

• Save the file anywhere but saving it inside the extracted sysmon folder is more convenient
• Copy the location of your sysmon extractions

• Open up powershell as admin and type in the following command (replace C:\Users\VmHome\Downloads\Sysmon with your own file path)
• cd simply means change directory

cd C:\Users\VmHome\Downloads\Sysmon

• Once you’re in the C:\Users\VmHome\Downloads\Sysmon directory, execute the following command

.\Sysmon.exe -i .\sysmonconfig.xml

• What this script does is tell windows to install(-i) the sysmon application (.\Sysmon.exe) based on .\sysmonconfig.xml
• Instead of logging everything which creates a lot of noise, the configuration file provides a domain on the basis of which logs are well…logged.
• If this doesn’t work, replace the .\Sysmon.exe with .\Sysmon64.exe - It should look something like this

• Click on agree and it should install
• You can verify your installation by searching for it in services

Sysmon is confirmed to be installed

• Another method to check is through Event Viewer
• Click on the dropdown for Application and Services, then Microsoft, then Windows and scroll down a bit, you should find Sysmon

• If you click on it’s dropdown and click on operational, you should see sysmon working already

Since we are on a fresh installation of sysmon and Windows, I recommend taking a snapshot of your system. This will help you revert back to a stable version should the need arise.

You can take the snapshot as it is running by clicking on the Machine tab of your VM and clicking on take a snapshot

Add description and names accordingly so you remember.

It is usually a good practise in home-labs to take a snapshot after each milestone

Lab-2 incoming I hope you found this guide/my documentation helpful :)

Please let me know if you incur any further errors.