Blue Team Fundamentals: Building a Detection Lab on a Budget

Mar 1, 2023 #blue-team Informational 2 min read

How to build a fully functional home detection lab using free tools, covering network visibility, log aggregation, and your first SIGMA rule from scratch.

Introduction

You don't need enterprise budget to build detection engineering skills. Over the past year I've built and rebuilt a home lab that now ingests logs from multiple sources, runs correlation rules, and alerts on simulated attacker behaviour. Here's how to do it from scratch for free.

Lab Architecture

The core stack:

VirtualBox — free hypervisor for running Windows and Linux VMs
Windows 10 VM — target machine for simulating attacks
Ubuntu Server VM — runs the ELK stack (Elasticsearch, Logstash, Kibana)
Sysmon — extended Windows event logging
Winlogbeat — ships Windows logs to Elasticsearch

Total cost: $0. Total setup time: one weekend.

Setting Up Sysmon

Sysmon is the single highest-value thing you can install on a Windows endpoint for detection purposes. Use the SwiftOnSecurity config as a starting point. It filters noise while capturing the events that matter.

Key event IDs to focus on:

Event ID 1 — Process creation (captures command line arguments)
Event ID 3 — Network connections
Event ID 11 — File creation
Event ID 22 — DNS queries

Your First Detection Rule

Once logs are flowing into Kibana, write your first SIGMA rule. Start simple and detect PowerShell downloading from the internet:

title: PowerShell Download Cradle
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'DownloadString'
            - 'WebClient'
            - 'Invoke-WebRequest'
    condition: selection

Convert this to an Elasticsearch query using sigma-cli and set up an alert in Kibana.

Simulating Attacks

Use Atomic Red Team to simulate ATT&CK techniques against your Windows VM. Each atomic test maps to a specific technique and gives you something concrete to detect. Then check whether your SIGMA rule fired. If not, investigate why and tune accordingly.

Conclusion

The gap between reading about detection engineering and actually doing it is bridged by a lab. Build it, break things in it, write rules, miss things, and iterate. That cycle is where real skill develops.

← cd ~