Security-Home-Lab - This repository provides a documented, physical an

项目说明

Security-Operations-Home-Lab

Lab Architecture & Technical O

This home lab is hosted on a Dell PowerEdge R620 ser Proxmox VE as the Type-1 hypervisor. The physical networking is isolated from the main ISP network using a dedicated Cisco Enterprise Router, Switch, and Firewall stack, ensuring a "sandbox" en for malware and attack simulation.

The Detection Lab project aimed to establish a controlled en for simulating and detecting cyber attacks. The primary focus was to ingest and analyze logs within a Security Information and Event Management (SIEM) system, generating test telemetry to mimic real-world attack scenarios. This hands-on experience was designed to deepen understanding of network security, attack patterns, and defensi.

Hardware Stack
Server: Dell PowerEdge R620 (Dual Intel Xeon, 128GB+ RAM recommended)

Hypervisor: Proxmox VE

Networking: Cisco Enterprise Router & Catalyst Switch (Hardware Isolation)

Firewall: pfSense (Internal routing and inter-VLAN control)

Ref 1: Network Diagram

<img width="617" height="792" alt="Infrastructure Diagram" src=" />

Network Segmentation (VLANs)

The en is segmented into three distinct zones to mimic a corporate infrastructure:

VLAN 40 (Attack LAN): 10.1.4.0/24 — Kali Linux instance for penetration testing and telemetry generation.

VLAN 20 (Target En - E Corp): 10.1.2.0/24 — Windows Domain Controller (DC-1) and Windows 11 endpoints (Win-11-1, Win-11-2).

VLAN 30 (Security Operations - Viper MSSP): 10.1.3.0/24 — Centralized monitoring using Wazuh (SIEM/XDR) and for endpoint and forensics.

Ref 2:Cisco Network Appliances
!Cisco

Ref 3: Dell Type 1 Hyperviser Ser VE
!Dell Poweredge r620

Tools Used

Proxmox for all server and client nodes.

Ref 4:Proxmox Node with Operating Systems Installed via ISO Images

<img width="1887" height="927" alt="Setup SOC Lab Infrastructure" src=" />

pfSense:

Installed ISO Image and will come back to setup later in series after we add Open (OVS)

Installed SPICE

(Simple Protocol for Independent Computing En):
Integrated to provide high-performance, low-latency remote console access to the endpoints. This allowed for seamless interaction with the Windows 11 targets and Kali Linux attack node, supporting multi-monitor setups and shared clipboards between the lab and the host machine.

Ref 5: SPICE

<img width="1895" height="252" alt="Setup Spice" src=" />

Open (O:

Replaced standard Linux bridges with Open within the Proxmox hypervisor. This upgrade provides a more robust, SDN-ready (Software Defined Networking) foundation, enabling ad features like VLAN tagging at the switch level and pro the infrastructure necessary for deep packet inspection and network telemetry.

Ref 6: OVS

<img width="1134" height="654" alt="Setup OVS" src=" />

pfSense:

Provided granular firewall rules between the Attack, , and SOC networks.

Ref 7-11: PfSense
<img width="1310" height="498" alt="Firewall Rules 1" src=" />

<img width="1241" height="472" alt="Firewall Rules 2" src=" />

<img width="1188" height="462" alt="Firewall Rules 3" src=" />

<img width="1213" height="411" alt="Firewall Rules 4" src=" />

<img width="1323" height="829" alt="Setup pfSense" src=" />

Deployment of Acti Domain Services (AD DS)

With the network infrastructure and gateways established, we deployed a Windows Ser to serve as the backbone of the "E Corp" corporate en. This step was essential for establishing centralized identity management and pro a realistic target for SOC monitoring and attack simulations.

Key Implementation Details:

Domain Controller Promotion: Configured the primary server as a Domain Controller (DC-1) for the ecorp.local forest.

DNS & DHCP Integration: Set up integrated DNS to handle internal name resolution for all domain-joined assets, ensuring seamless communication across the 10.1.2.0/24 subnet.

Organizational Unit (OU) Structure: Created a logical hierarchy within AD to manage users, groups, and workstations, mirroring a standard business en.

Group Policy Objects (GPOs): Initialized baseline security policies and audit logging configurations. This is a critical step for the SOC lab, as it ensures the Windows endpoints generate the necessary event logs (like Process Creation and PowerShell logging) for Wazuh to ingest.

Snapshot Strategy: Prior to promotion, a Proxmox snapshot was taken to establish a "clean slate" recovery point for the domain en.

Ref 12: Acti

<img width="960" height="725" alt="Setup Users and Groups" src=" />

Intentional Deacti of Windows Defender

During the "E Corp" domain setup, Windows Defender was intentionally disabled across the Windows endpoints and the Domain Controller. While counterintuitive in a production en, this was done for two specific technical reasons:

Telemetry Isolation: By removing the "noise" and automated blocking of Windows Defender, we ensured that the Wazuh and agents were the primary sources of telemetry. This allows us to see exactly how these specific SOC tools detect and alert on raw, unblocked malicious activity.

Attack Simulation Accuracy: In a learning en, Defender often "kills" exploits before they can execute. Disabling it allows us to study the full lifecycle of an attack—from initial execution to lateral mo—pro a much richer dataset for log analysis and beha detection tuning.

Performance Optimization: Reducing background resource consumption on the nodes ensures the Dell R620 can maintain high performance during hea testing.

Ref 13-14: Disabled Windows Security

<img width="1890" height="996" alt="Setup Disable Windows Defender" src=" />

<img width="1854" height="986" alt="Start UP Enable Disable GP MS Defender" src=" />

User Management & Domain Integration

Once the Domain Controller was stabilized, we populated the en with users and configured the necessary policies to ensure the endpoints were ready for acti.

Key Implementation Details:

User & Group Creation: Established a set of "" user accounts and administrati within Acti to simulate a real-world workforce.

Domain Joins: Successfully joined the Win-11-1 and Win-11-2 workstations to the ecorp.local domain, that the DNS settings through pfSense and the DC were correctly resolving.

Security & Audit Policies:

Configured Group Policy Objects (GPOs) to enable "Audit Process Creation" and "Include Command Line in Process Creation Events" (Event ID 4688).

Enabled PowerShell Script Block Logging to ensure that any malicious scripts executed during testing would be captured in the logs for the SIEM to ingest.

: Logged into the workstations using the newly created domain credentials to confirm profile synchronization and policy application.

Ref 15: User Group and Policies

<img width="960" height="725" alt="Setup Users and Groups" src=" />

Ref 16-17: Joined Users to Domain

<img width="1883" height="1010" alt="Setup User Joined Domain confirm" src=" />

<img width="1908" height="942" alt="Setup, Join endpoint to Domain" src=" />

Configuration of Enterprise SMB File Shares

To simulate a realistic corporate data en and create targets for lateral mo detection, we configured an SMB (Ser Block) share on the "E Corp" Domain Controller (DC-1).

Implementation Highlights:

Resource Pro: Created a dedicated directory structure (C:\Shares\Company_Data) to act as a centralized file repository for domain users.

Permission Management: Configured NTFS and Share Permissions for the newly created domain users and groups, ensuring "least pri" access models were followed.

Security Auditing: Enabled File Object Auditing within the Windows Security Policy. This ensures that every time a file is accessed, modified, or deleted, a log is generated (Event ID 4663), which is then picked up by our SOC monitoring tools.

SOC Utility: This share serves as a primary target for "In-House" attack simulations, such as searching for sensiti or testing for "SambaCry" style exploits and unauthorized network share enumeration.

Ref 18-20: SMB Share

<img width="1885" height="1015" alt="Setup New Share SMB Share Quick" src=" />

<img width="1821" height="956" alt="Setup SMB Share Command Line" src=" />

<img width="1324" height="879" alt="Setup SMB Share 2 Command Line Confirm" src=" />

Deployment of Microsoft Sysmon

To augment the standard Windows Event Logs, we deployed Microsoft Sysmon across all "E Corp" endpoints. This provides the high-fidelity telemetry required for ad threat hunting and beha analysis.

Implementation Highlights:

Granular : Configured Sysmon to capture critical events that standard logging often misses, such as Process Creation (Event ID 1) with full command-line arguments, Network Connections (Event ID 3), and File Creation (Event ID 11).

Configuration Schema: Utilized a customized configuration file (based on industry standards like SwiftOnSecurity) to filter out "noise" while ensuring that suspicious activity—such as Rundll32 executing code or unusual PowerShell behavior—is strictly logged.

SIEM Integration: Established the foundation for Wazuh to ingest these Sysmon logs, allowing us to build detection rules based on specific sub-processes and hash (SHA256) captured by the tool.

: Confirmed successful installation via the Windows Event (Applications and Services Logs > Microsoft > Windows > Sysmon > Operational), ensuring logs were being generated in real-time.

Ref 21-25: Sysmon

<img width="1889" height="850" alt="Setup Sysmon 1" src=" />

<img width="1889" height="963" alt="Setup Sysmon 2 Github Modular" src=" />

<img width="1900" height="978" alt="Setup Sysmon 3 Modular Cut Paste to Notepad" src=" />

<img width="1519" height="808" alt="Setup Sysmon 4 CLI Command" src=" />

<img width="1689" height="956" alt="Setup Sysmon Event " src=" />

Implementation of Wazuh SIEM & XDR

With high-fidelity telemetry being generated by Sysmon and Windows Event Logs, we deployed Wazuh as the central Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) platform for the lab.

Key Implementation Details:

Ser: Installed the Wazuh manager on a dedicated Ubuntu-based ser the Viper MSSP (VLAN 30) segment, ensuring the SOC management traffic is isolated from the attack and networks.

Agent Deployment: Installed and registered Wazuh agents on the Windows Domain Controller, Windows 11 endpoints, and the Kali Linux node.

Log Ingestion & Integration:

Configured the ossec.conf file on the Windows agents to ingest Sysmon and Windows Event Logs.

Enabled File Integrity Monitoring (FIM) to track unauthorized changes to sensiti files and the SMB shares.

Management: Activated the Wazuh Detector to automatically scan domain-joined assets for missing patches and known CVEs.

Dashboard : Confirmed that telemetry from the "E Corp" domain was successfully hitting the Wazuh indexer, pro a real-time "bird's-eye view" of the entire lab's security posture.

Ref 26-27: Wazuh

<img width="1628" height="866" alt="Setup Wazuh Install Agent" src=" />

<img width="1907" height="894" alt="Setup Wazuh Agents Dashboard" src=" />

Deployment of for Ad Digital Forensics & Incident Response (DFIR)

To complement the real-time alerting of Wazuh, we deployed as our primary endpoint and forensic collection tool. This provides the lab with the ability to perform deep-dive "hunts" and rapid triage across the "E Corp" domain.

Implementation Highlights:

Architecture: Deployed the server on a dedicated Ubuntu instance within the Viper MSSP (VLAN 30) segment.

Agent Deployment: Created a custom, self-signed client configuration and deployed as a persistent service across all Windows 11 endpoints and the Domain Controller.

VQL ( Query Language): Le VQL to execute targeted collections, such as searching for specific persistence mechanisms (e.g., Scheduled Tasks, Registry Run keys) or hunting for Indicators of Compromise (IoCs).

Forensic Capabilities:

Triage Collection: Configured "KapeFiles" artifacts to quickly collect critical forensic artifacts (MFT, Event Logs, Registry Hives) in seconds rather than hours.

Process Analysis: Used the Windows.System.Pstree artifact to process hierarchies, which is essential for identifying malicious parent-child process relationships.

Integration Value: This setup allows us to "pivot" from a Wazuh alert to a hunt, enabling us to immediately in the state of a compromised machine without leaving the SOC management network.

Ref 28-30

<img width="1890" height="965" alt="Setup Ubuntu Server" src=" />

<img width="1892" height="983" alt="Setup agents dashboard" src=" />

<img width="1870" height="970" alt="Setup GUI" src=" />

En Finalization & Snapshot Strategy

To conclude the foundational build of the Security-Home-Lab, we implemented a comprehensi strategy within Proxmox. This ensures that the en is "immutable" for future research, allowing us to launch aggressi simulations and revert to a known-clean state in minutes.

Key Finalization Steps:

Golden Image State: that all agents (Wazuh, , Sysmon) were communicating correctly and that the E Corp domain was fully synchronized.

Proxmox Snapshots: Captured a "Baseline" snapshot for every machine on the Dell PowerEdge R620. This baseline represents a fully patched, configured, and monitored enterprise en.

Storage Optimization: Confirmed that the disks were thin-pro and the O was stable across the entire hypervisor node.

Transition to Research: With the infrastructure finalized, the lab is now transitioned into its primary role: a sandbox for indi SOC Projects, where we will simulate ad persistent threats (APTs), ransomware deployments, and lateral mo scenarios.

Skills Learned

-Building Enterprise Networks: Set up a full-scale security lab on a Dell R620 using Proxmox and Cisco gear to simulate a real-world corporate network.
-Network Security & Isolation: Mastered traffic control by using pfSense and Open (OVS) to keep attack traffic strictly separated from the rest of the lab.
-Acti Management: Built a "" domain from scratch, using Group Policies (GPOs) to force the systems to log every detail for our security tools.
-SIEM & Telemetry Expertise: Linked Sysmon and Wazuh to catch malicious activity in real-time, turning raw logs into actionable security alerts.
-Threat Hunting & Forensics: Learned how to "hunt" for hackers using , allowing me to pull forensic data and find hidden threats instantly.

#### Follow my main page below to see all and upcoming Projects.
![]()

项目信息

开发语言：未知

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This repository provides a documented, physical and virtual environment for building, testing, and hardening security infrastructure through hands-on research and defensive engineering.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。