SOC Detection & Telemetry Home Lab
A dedicated virtualized SOC engineering environment with Windows 11 endpoints, Sysmon, Splunk Enterprise, and Atomic Red Team for detection rule testing.
The Problem
Gaining practical SOC investigation skills requires hands-on experience generating, forwarding, and querying realistic operating system telemetry under simulated attack conditions.
Project Context
Built an on-premise virtualized testing lab using Hyper-V and Docker to safely emulate adversary techniques, evaluate detection fidelity, and author custom alert logic.
System Architecture & Data Flow
The architecture routes endpoint and network telemetry through a centralized pipeline into Splunk Enterprise for real-time alerting and hunting.
Windows 11 Workstation + Ubuntu Server endpoints run isolated on an internal virtual switch.
Sysmon v15 deployed on Windows with SwiftOnSecurity configuration capturing process execution, network sockets, and file integrity events.
Splunk Universal Forwarder ingests Windows Event Logs, Sysmon, and Linux journald/auth logs via TLS 1.3.
Central Splunk Indexer normalizes events according to Common Information Model (CIM) standards.
Custom SPL correlation searches trigger alerts mapped directly to MITRE ATT&CK techniques.
Adversary simulation executed via Atomic Red Team and PowerShell scripts in a controlled sandbox.
Technologies & Tools Used
Security Considerations
- •Lab VMs run on an isolated private vSwitch with default egress disabled to prevent outbound malware propagation.
- •Atomic test commands are vetted before execution to ensure they only execute non-destructive diagnostic actions.
- •Splunk forwarder communications use mutual TLS certificates to protect telemetry in transit.
- •Snapshots taken before each simulation run to allow immediate rollback to a known pristine baseline.
Implementation Notes
• Tuned Sysmon XML to suppress noisy background events (e.g. OneDrive sync, Windows Defender signature updates) reducing daily log volume by 42%.
• Authored 14 detection rules including Base64 PowerShell execution, LSASS memory access, and suspicious scheduled task creation.
• Created analyst dashboard in Splunk highlighting top failed logons, process anomalies, and network connections to non-standard ports.
Engineering Challenges
Verified Results
- Successfully verified detection rules for 18 distinct MITRE ATT&CK techniques.
- Reduced average alert investigation time in lab exercises through curated dashboard views.
- Serves as the foundation for all documented SOC investigation write-ups on this portfolio.
Lessons Learned
- •High-quality logging configuration (like Sysmon) is more critical for threat detection than raw log volume.
- •Parent-child process relationship analysis catches obfuscated attacks that evade simple string-matching rules.