orevic21/wazuh-home-soc

This project is a home built security monitoring lab that demonstrates how to detect real cyberattacks, not just how to install security software. It sets up a small practice environment with three virtual computers: one acting as an attacker, one acting as a deliberately vulnerable, outdated target, and one running the security monitoring system that watches for suspicious activity. The interesting design choice is that the vulnerable target computer is running such an old operating system that it cannot run any modern monitoring software directly on it, similar to how old industrial equipment or forgotten devices on a real network often cannot be monitored the usual way. Instead of giving up on watching that machine, the project routes around the problem by watching the network traffic flowing to and from it using a separate network monitoring tool, so it can still catch attacks even though the target itself reports nothing. The lab then runs several real, well known attacks against the vulnerable target and shows how each one gets caught. A network scan gets flagged by built in detection rules within seconds. A well known backdoor vulnerability that gives an attacker full root access is caught because the security tool spots a giveaway phrase crossing the network at the moment the attacker gains that access. A slower attack that tries many passwords in a row against a file transfer login is captured too, but the author notes that the standard detection rules do not have a ready made alert for that kind of repeated password guessing, since it is a pattern of behavior rather than a single known bad signal. To close that gap, the author writes a custom detection rule from scratch. Throughout the write up, the author is honest about what worked, what did not, and what is still being debugged, including a custom rule that is not yet firing reliably. The lab requires virtualization software to run the three practice computers and is meant for people learning or practicing security monitoring and detection engineering skills, not for use on any real production system.