Structured attack and defence practice
Building a deep understanding of attacker tactics, and how those attacks actually appear inside SOC analyst tools. Lessons learned from building detection from scratch.
SESSION 2
Fixing log collection to catch the scan
The scan was barely visible in Wazuh because it was not reading the right log files. Fixed file permissions, expanded log collection, and wrote a custom rule that correctly fired on the scan.
SESSION 3
Reading Splunk properly to investigate an attacker
Logs were arriving unparsed with no searchable fields. Fixed the source type mapping, then ran a full investigation from zero and found one IP that had scanned every web application on the box.
SESSION 4
Comparing how three tools see the same scan
Watched the same nmap scan appear three different ways: a high level alert in Wazuh, raw log detail in Splunk, and full process level behaviour in LimaCharlie, including a root process with no alert raised.
SESSION 5
Why the SIEM missed it and the EDR didn’t
Used a documented backdoor exploit to get a working shell. Wazuh missed the entire attack because it never touched a monitored log file. LimaCharlie caught the full process chain at the kernel level.
SESSION 6
Writing a detection rule to close that gap
Built a LimaCharlie rule from scratch to catch the exact pattern Session 5 missed. Tested it against fake data first, then re ran the real exploit twice to confirm it fired against the actual attack.
| SESSION 1 Reconnaissance scan against Metasploitable 3 Ran nmap against the target to learn how reconnaissance shows up in Wazuh, Splunk, and LimaCharlie. Found a gap: no single alert tied the individual service alerts together as one port scan. | |
| SESSION 2 Fixing log collection to catch the scan The scan was barely visible in Wazuh because it was not reading the right log files. Fixed file permissions, expanded log collection, and wrote a custom rule that correctly fired on the scan. | |
| SESSION 3 Reading Splunk properly to investigate an attacker Logs were arriving unparsed with no searchable fields. Fixed the source type mapping, then ran a full investigation from zero and found one IP that had scanned every web application on the box. |