Active-Directory-Detection-Lab

Objective

The Detection Lab project aimed to establish a controlled environment for simulating and detecting cyber attacks. The main goal was to analyze logs in Splunk and generate telemetry to mimic real-world attacks scenarios. This hands on experience has helped me Develop the understanding of SIEM tools like splunk,

Skills Learned

• Advanced understanding of SIEM concepts and practical application.
• Proficiency in analyzing and interpreting network logs.
• Ability to generate and recognize attack signatures and patterns.
• Enhanced knowledge of network protocols and security vulnerabilities.
• Development of critical thinking and problem-solving skills in cybersecurity.

Tools Used

• Splunk (SIEM) system for log ingestion and analysis.
• Oracle VM VirtualBox
• Telemetry generation tools to create realistic network traffic and attack scenarios.
• windows 10, kali linux, and ubuntu operating systems used to create realistic envirnment
• crowbar (Telemetry)
• atomic red team (Telemetry)

Steps

Diagram

STEP 1: Download the following VMs

• Windows 10(Victim)
• Kali-Linux(Attacker)
• Windows Server
• ubuntu(Splunk server)

Step 2: Install and Configure Sysmon and Splunk

-install splunk and create a user

-install sysmon

• 

-import pre-installed sysmon configurations

-install and configure splunk UF

-create index and enable splunk to receive data

-repeat steps on windows server

Step 3: Configure Windows Server And Active Directory

-install active directory domain services

-promote server to domain controller

-create new organizational unit with users

-add target pc to domain

Step 4: perform brute force attack and view telemetry in splunk

-save the top 20 passwords from rockyou.txt to password.txt and add the correct passwords

• rockyou.txt is a preinstalled list with over 100 passwords on linux

-execute bruteforce against user Tsmith with crowbar

-view telemetry in splunk

Step 4: perform MITRE ATT&CK T1059.001 using ART and view telemetry in splunk

-perfrom attack using ART, the attack creates a new user

-view telemetry in splunk