Incident response lab
Simulated compromise of a Windows endpoint to practice the NIST cycle: detection, containment, eradication and lessons learned.
Study lab in an isolated, authorized environment using my own or intentionally vulnerable systems. No third-party systems were tested.
Problem
During a real incident there's no time to learn the process. Rehearsing the full cycle in a controlled environment makes the response faster and better organized.
Technical goal
Run MITRE ATT&CK techniques on a VM, detect them with endpoint telemetry and carry the response end to end.
How it was done
Prepare: Windows VM with Sysmon and a Wazuh agent, clean snapshot and isolated network.
Simulate techniques with Atomic Red Team, such as persistence and PowerShell execution.
Detect in the SIEM and build the timeline from Sysmon events.
Contain by isolating the VM and preserve the evidence.
Eradicate persistence, restore and validate.
Write the report and lessons learned, including detection tuning.
Evidence
<RuleGroup name="Persistencia" groupRelation="or"> <RegistryEvent onmatch="include"> <TargetObject condition="contains">\CurrentVersion\Run</TargetObject> </RegistryEvent> <ProcessCreate onmatch="include"> <ParentImage condition="end with">\powershell.exe</ParentImage> </ProcessCreate></RuleGroup>Key takeaways
- Preserve evidence before cleaning up; haste erases what would explain the incident.
- Every simulation ends with a detection tweak.
- A clear timeline is what makes the report useful to people who weren't there.