SOC Home Lab Guide Book

SOC Home Lab

This guide presents a comprehensive walkthrough for building and operating a

Security Operations Center (SOC) Home Lab, designed to simulate both Red Team
(offensive) and Blue Team (defensive) Cyber Security operations.

The lab environment includes a Wazuh server (SIEM Solution) running on Ubuntu, a
Windows 10 endpoint configured as an agent, and a Kali Linux machine acting as the
attacker. Each component has been configured and tested through realistic threat
scenarios to provide hands-on experience in detecting, responding to, and analyzing
cyberattacks.

Prepared by: Hazem Ahmed

1|Page
 SOC Home Lab Guide Book

Table of Contents

1. Overview ………………………………………………………………………………………………….3

2. Lab Environment Setup …………………………………………………………………………………4

3. Tools Used ....……………………………………………………………………………………………….5

4. Day 1: Wazuh Server Setup (Ubuntu) .….………………………………………………………………6

5. Day 2: Windows 10 Victim (Wazuh Agent Setup) .….…………………………………………………9

6. Day 3: Attacker Machine (Kali Linux) ….………………………………………………………………..14

7. Day 4: Attack Simulation and Log Analysis ….…………………………………………………………15

8. Lessons Learned …………………………………………………………………………………………19

9. Conclusion ……………………………………………………………………………………………….. 20

10. Future Steps ………………………………………………………………………………………20

2|Page
 SOC Home Lab Guide Book

1. Overview

This hands-on Cyber Security project simulates both Red Team (attacker) and Blue Team (defender)

operations within an isolated SOC lab environment. The objective is to understand the full cycle of attack

detection and response using widely adopted open-source security tools such as Wazuh (SIEM), Suricata

(IDS), and Snort (IDS).

The lab demonstrates how real-world attacks can be detected through log monitoring, alert generation, and

real-time network traffic analysis. Tools like Nmap, Hydra, and Metasploit were used to simulate attacker

behavior, while Wazuh, integrated with Suricata, Snort, and rsyslog, provided centralized visibility and

detection from the defender’s perspective.

This environment offers a practical understanding of how a modern SOC operates to monitor, analyze, and

respond to cyber threats effectively.

3|Page
 SOC Home Lab Guide Book

2. Lab Environment Setup

Three virtual machines were used:

- Ubuntu (Wazuh-Server): Hosts Wazuh Server to monitor logs

- Windows 10 (Victim): Windows agent acting as the victim machine which will be attacked

- Kali Linux (Attacker): Attacker machine to simulate a real world attack scenario

All machines are on the same network on VMware using Bridged network mode .

4|Page
 SOC Home Lab Guide Book

3. Tools Used

Blue Team Tools:

- Wazuh: SIEM platform used for log collection, analysis, and real-time alerting.

- Suricata: Network IDS for live traffic inspection and threat detection.

- Snort: Packet analysis tool used to analyze (.pcap) files and detect known attack signatures

- rsyslog: Log forwarding tool that sends system and network logs to Wazuh.

- Windows Defender: Built-in antivirus that detects malware and suspicious behavior on the Windows machine.

- OpenSSH: Remote access service enabled on the Windows machine to simulate login attacks.

- IIS FTP Server: Allows file upload/download for simulating payload delivery.

Red Team Tools:

- Nmap: Scanning tool used to discover open ports and services on the target.

- Hydra: Brute-force tool used to guess login credentials over SSH and FTP.

- Metasploit: Exploitation framework used to handle payloads and simulate post-exploitation.

- Msfvenom: Payload generator used to create reverse shell executables.

5|Page
 SOC Home Lab Guide Book

4. Day 1: Wazuh Server Setup (Ubuntu)

Installed Wazuh as SIEM solution

after installation accessed the web Dashboard from browser.

credentials for login known from the installation process.

Installed Suricata as NIDS

Configured Suricata for real-time IDS with syslog output to Wazuh.

Made these configurations

6|Page
 SOC Home Lab Guide Book

Installed Snort for analyzing PCAP files

Configured Snort to analyze PCAP files separately.

Scrolled down to uncomment this section

Save edits and exit

Configured rsyslog to forward logs

rsyslog set up to forward all logs and Suricata alerts over TCP port 514.

Configured Wazuh manager to receive logs from rsyslog on port 514

Scroll down and added this section

7|Page
 SOC Home Lab Guide Book

To enable Wazuh to analyze intrusion detection alerts from both Suricata and Snort, two <localfile>
configurations were added also inside the ([Link]) file. These configurations allow Wazuh to ingest and
parse the log files locally on the server, enabling real-time alerting and correlation.

Lastly restart all services (Wazuh-manager, Suricata, Snort and rsyslog)

8|Page
 SOC Home Lab Guide Book

5. Day 2: Windows 10 Victim (Wazuh Agent Setup)

Installed Wazuh agent

Deployed a new agent from the web dashboard

Configured ([Link]) to include Windows Defender and Firewall

logs.

Get Windows defender logs from Event Viewer

Choose windows defender and then choose Operational

9|Page
 SOC Home Lab Guide Book

Copied the log name and add it in the ([Link]) file.

Enabled SSH and created user 'admin' with basic password

for remote access

From Powershell run this command

Enabled SSH service

Then

10 | P a g e
 SOC Home Lab Guide Book

Confirmed SSH Service is running

Enabled FTP service via IIS, allowed full access to C:\FTP\Uploads, and created FTP site on
port 21

From Powershell run these commands

Created FTP uploads folder

Permissions for all users

11 | P a g e
 SOC Home Lab Guide Book

Adding FTP site from IIS (Internet Information Services)

Right Click on Sites and Add FTP Site

IP Address is IP of Windows machine (192.168.X.X)

12 | P a g e
 SOC Home Lab Guide Book

Allowed access to all users and all permissions

Allowed FTP connection through firewall

Confirmed FTP service is running like we did in SSH

13 | P a g e
 SOC Home Lab Guide Book

6. Day 3: Attacker Machine (Kali Linux)

Used Nmap for initial port scanning.

Used Hydra to attempt brute-force SSH.

Uploaded payload via FTP after login success.

14 | P a g e
 SOC Home Lab Guide Book

7. Day 4: Attack Simulation and Log Analysis

Scanned victim and found ports 21, 22, 80.

Suricata detected the network scanning and sent the log to Wazuh

Used Hydra with known username to brute-force SSH (rate limited).

Rate limit forced hydra to stop so I logged in using credentials for the

admin user I have created before and failed login attempts logs were

alerted

15 | P a g e
 SOC Home Lab Guide Book

Wazuh alerted that there is a remote session started on port 22

Tried privilege escalation (failed, logged by Admin).

Wazuh monitored the logs of privilege escalation

Logged in via FTP and uploaded malicious (.exe.)

16 | P a g e
 SOC Home Lab Guide Book

Wazuh monitored the FTP login success and the

file upload

17 | P a g e
 SOC Home Lab Guide Book

Windows Defender deleted the payload silently.

All actions logged and displayed in Wazuh.

18 | P a g e
 SOC Home Lab Guide Book

8. Lessons Learned

This project provided a complete, hands-on simulation of both offensive (Red Team) and defensive (Blue

Team) cybersecurity operations. By acting as both the attacker and the defender, several important insights

were gained:

• Centralized Log Management: Integrating multiple log sources into Wazuh enhanced the ability to

detect, correlate, and respond to various attack vectors in real time.

• Value of Defense in Depth: The combination of host-based defenses (like Windows Defender),

network-based detection (Suricata), and log correlation (Wazuh) provided multi-layered visibility and

early threat detection.

• Understanding Attack Patterns: Simulating real-world attacks using tools like Nmap, Hydra, and

Metasploit clarified how adversaries operate and what indicators of compromise (IOCs) they leave

behind.

• Importance of Least Privilege: Creating and exploiting limited user accounts demonstrated how

privilege restrictions can prevent or delay escalation attempts.

• System Hardening and Misconfigurations: Enabling insecure services like FTP highlighted how

overlooked configurations can expose systems to exploitation and how security hygiene plays a critical

role.

• Detection and Response Workflow: From initial detection through Wazuh to deeper log analysis, this

project demonstrated the critical workflow involved in a modern Security Operations Center (SOC).

19 | P a g e
 SOC Home Lab Guide Book

9. Conclusion

This SOC Home Lab project brought together both offensive and defensive cybersecurity practices in a
realistic, controlled environment. By simulating attacks from a Kali Linux machine and defending with open
source tools on a centralized Ubuntu SIEM server, I was able to visualize how threats are detected,
analyzed, and responded to in real time.

From configuring Wazuh for log aggregation to integrating Suricata and Snort for network threat detection,
each component played a critical role in creating a comprehensive view of system and network activity.
Events like SSH brute force attempts, privilege escalation failures, and malicious payload uploads were all
captured, logged, and visualized in Wazuh giving insight into both attacker behavior and defender
response.

This project not only sharpened my technical skills but also deepened my understanding of how modern
SOCs operate, how logs become actionable intelligence, and how Red Team tactics are countered by Blue
Team defenses. It also reinforced how critical Defense in Depth and System Hardening are in reducing the
attack surface and improving detection at every layer.

10. Future Steps

While this project has successfully demonstrated a full Red Team vs. Blue Team simulation with centralized
monitoring, log correlation, and alert generation, there are several opportunities to expand the lab and
improve both detection and analysis capabilities:

Integrate Wireshark for Live Traffic Analysis

The next step involves introducing Wireshark into the environment to capture and analyze network traffic
during live attacks. This will allow for deep packet inspection and protocol-level visibility, helping to
understand how attacks manifest on the wire and how IDS tools like Suricata and Snort interpret them.

Simulating Lateral Movement and Persistence

Future simulations may involve more advanced adversary techniques such as lateral movement across
systems, persistence mechanisms, and scheduled task creation, with the goal of observing and detecting them
within the SIEM.

20 | P a g e