lab-soc-linux - SOC and Linux security labs focused on log analysi

项目说明

🛡️ Linux SOC & DFIR Labs – Monitoring, Detection, In & Incident Response

!SIEM
!Detection
!OS
!Status

Practical SOC/DFIR labs demonstrating real-world detection, threat hunting, in, persistence analysis, and incident response using Wazuh, auditd, and Linux telemetry.

Hands-on labs focused on Security Operations Center (SOC), Detection Engineering, and DFIR practices using Linux, Wazuh (SIEM), auditd, Suricata, and log analysis.

---

🎯 Objective

Simulate realistic attack scenarios and perform the complete SOC/DFIR workflow:

Monitoring and telemetry collection

Detection and threat

In (timeline, process analysis, IoCs, persistence hunting)

Threat classification (MITRE ATT&CK mapping)

Incident response (containment, eradication, recovery)

Defense and hardening

---

🧠 SOC Methodology

Monitoring → Detection → In → Classification → Response

---

🚨 Key Skills Demonstrated

Linux incident response and li in

Persistence hunting (cron, SSH keys, systemd services)

Process and parent-child relationship analysis

EXEC analysis with auditd

Threat hunting and IoC collection

SIEM monitoring and telemetry (Wazuh)

Detection gap identification and manual in

MITRE ATT&CK mapping and threat classification

Incident response (containment, eradication, recovery)

Linux hardening and persistence mitigation

DFIR-oriented in workflow

---

🧰 Tools

Wazuh (SIEM)

auditd

auth.log

Fail2ban

iptables

Linux CLI

Suricata (IDS/NSM)

tcpdump

jq

ps / pstree

ss / netstat

systemctl

cron

---

📊 Highlighted Labs

| Lab | Description | Technologies | MITRE |
|-----|------------|-------------|-------|
| 20 | Brute force detection + automated blocking (Fail2ban integration) | Wazuh, Fail2ban | T1110.001 |
| 21 | Web attack detection + correlation (HTTP logs + SIEM) | Wazuh, web logs | T1190, T1059 |
| 22 | SSH brute force detection using SIEM (Wazuh rules) | Wazuh | T1110.001 |
| 23 | SSH brute force detection + in (timeline + IoCs) | Wazuh | T1110.001 |
| 24 | SSH brute force detection + event correlation (SIEM rules) | Wazuh | T1110.001 |
| 25 | SSH brute force detection + response + remediation (Fail2ban) | Wazuh, Fail2ban | T1110.001 |
| 26 | SSH brute force detection + network correlation | Wazuh, logs | T1110.001 |
| 27 | SSH brute force detection (manual log analysis, no SIEM) | Linux logs, auth.log | T1110.001 |
| 28 | SSH brute force + valid access + persistence (no SIEM correlation) | Linux logs, auth.log | T1110.001, T1078, T1098 |
| 29 | SSH brute force + valid access + persistence + log tampering | Wazuh, auth.log | T1110.001, T1078, T1098, T1070.004 |
| 30 | SSH brute force + valid access + persistence + log tampering + response | Wazuh, auth.log, auditd, Fail2ban | T1110.001, T1078, T1098, T1070.004, T1059 |
| 31 | Web shell upload + remote command execution (RCE) + post-exploitation in + response | Wazuh, Apache (access.log), DVWA | T1190, T1505.003, T1059 |
| 32 | DNS tunneling + data exfiltration + beha detection + egress filtering containment | Suricata (eve.json), tcpdump | T1048.003, T1071.004 |
| 33 | SQL Injection (SQLi) + data exfiltration + enumeration detection + response | Wazuh (log analysis), Apache (access.log), DVWA | T1190, T1048, T1087 |
| 34 | Linux persistence + li + auditd detection + process in + persistence hunting | Wazuh, auditd, Linux, Apache | T1059, T1053.003, T1098.004, T1543.002 |

---

📂 Lab Structure

Each lab includes:

README.md → attack o, detection workflow, in summary, MITRE mapping, and response actions

report.md → detailed SOC/DFIR incident report with timeline, IoCs, persistence analysis, and response

E → logs, telemetry, alerts, process analysis, screenshots, and in artifacts

---

🔍 Detection Examples

Wazuh — Authentication Correlation

Rule: 40112

Event: Multiple authentication failures followed by successful login

Detection Logic:

- Brute force behavior correlation
- Authentication anomaly
- Suspicious login sequence analysis

auditd — Linux EXEC

Event: Suspicious command execution detected

Commands Observed:

- curl
- wget
- chmod
- bash

Detection Context:

- Linux process execution telemetry
- Persistence activity monitoring
- Li in support

MITRE ATT&CK

T1110 — Brute Force

T1078 — Valid Accounts

T1059 — Command and Scripting Interpreter

T1053.003 — Cron

T1543.002 — Systemd Service

---

🧑‍💻 Author

Tiago Krysiaki
Focus: SOC Analyst | Blue Team | Detection Engineering | DFIR

LinkedIn:
Email:

---

!GitHub Stats

项目信息

开发语言：未知

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕SOC and Linux security labs focused on log analysis, incident investigation and defensive security practices.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。