DetectionLab - Automate the creation of a lab environment complet

项目说明

Detection Lab

As of 2023-01-01, DetectionLab is no longer being actively maintained

!DetectionLab

DetectionLab is tested weekly on Saturdays via a scheduled CircleCI workflow to ensure that builds are passing.

!Lint Code Base
![license]()
!Maintenance
![GitHub last commit]()
![Twitter]()

Purpose

This lab has been designed with defenders in mind. Its primary purpose is to allow the user to quickly build a Windows domain that comes pre-loaded with security tooling and some best practices when it comes to system logging configurations. It can easily be modified to fit most needs or expanded to include additional hosts.

Read more about Detection Lab on Medium here:

NOTE: This lab has not been hardened in any way and runs with default credentials. Please do not connect or bridge it to any networks you care about. This lab is deliberately designed to be insecure; the primary purpose of it is to provide and introspection into each host.

Primary Lab Features:

* Microsoft Ad Threat Analytics () is installed on the WEF machine, with the lightweight ATA gateway installed on the DC
* A Splunk forwarder is pre-installed and all indexes are pre-created. Technology add-ons are also preconfigured.
* A custom Windows auditing configuration is set via GPO to include command line process auditing and additional OS-le
* Palantir's Windows Event Forwarding subscriptions and custom channels are implemented
* Powershell transcript logging is enabled. All logs are saved to \\wef\pslogs
* osquery comes installed on each host and is pre-configured to connect to a Fleet 服务端 via TLS. Fleet is preconfigured with the configuration from Palantir's osquery Configuration
* Sysmon is installed and configured using Olaf Hartong's open-sourced Sysmon configuration
* All autostart items are logged to Windows Event Logs via AutorunsToWinE
* Zeek and Suricata are pre-configured to monitor and alert on 网络 traffic
* Apache Guacamole is installed to easily access all hosts from your local browser

---

Building Detection Lab

When preparing to build DetectionLab locally, be sure to use the prepare.[sh|ps1] scripts inside of the folder
to ensure your system passes the prerequisite checks for building DetectionLab.

* Prerequisites
* MacOS - or Fusion
* Windows - or Workstation
* Linux - or Workstation
* AWS
* Azure & Ansible
* ESXi & Ansible
* HyperV
* LibVirt
* Proxmox

---

DetectionLab Documentation

The primary documentation site is located at

* Basic Usage
* Lab Information & Credentials
* Troubleshooting and Known Issues

---

Contributing

Please do all of your de in a feature branch on your own fork of DetectionLab.
Contribution guidelines can be found here: CONTRIBUTING.md

In the Media

* DetectionLab, Chris Long – Paul’s Security Weekly #593
* TaoSecurity - Trying DetectionLab
* Setting up Chris Long's DetectionLab
* Detection Lab: & Introspection for Defenders

Credits/Resources

A sizable percentage of this 代码 was borrowed and adapted from Stefan Scherer's packer-windows and adfs2 Github repos. A huge thanks to him for building the foundation that allowed me to design this lab en.

Acknowledgements

* Microsoft Ad Threat Analytics
* Splunk
* osquery
* Fleet
* Windows Event Forwarding for 网络 Defense
* palantir/windows-e
* osquery Across the Enterprise
* palantir/osquery-configuration
* Configure Event Log Forwarding in Windows 服务端 2012 R2
* Monitoring what matters — Windows Event Forwarding for e
* Use Windows Event Forwarding to help with intrusion detection
* The Windows Event Forwarding Survi
* PowerShell ♥ the Blue Team
* Autoruns
* TA-microsoft-sysmon
* SwiftOnSecurity - Sysmon Config
* ThreatHunting
* sysmon-modular
* Atomic Red Team
* Hunting for Beacons
*
* BadBlood
* PurpleSharp
* E

DetectionLab Sponsors

#### Last updated: 01/01/2023
I would like to extend thanks to e who sponsored DetectionLab over the past few years. DetectionLab is no longer actively being maintained or de.

项目信息

开发语言：HTML

Star 数：5030

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Automate the creation of a lab environment complete with security tooling and logging best practices展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。