Listen to this Post
Introduction
In the rapidly evolving landscape of cybersecurity, theoretical knowledge alone is insufficient to prepare for real-world threats. Security Operations Centers (SOCs) rely on continuous monitoring, log analysis, and rapid incident response—skills that are best developed through practical, hands-on experience. Building a home lab environment that simulates an attacker-victim network allows aspiring security professionals to explore how security events are generated, collected, and analyzed, bridging the gap between classroom learning and operational readiness.
Learning Objectives
- Configure an isolated virtual lab environment using Oracle VirtualBox with Windows 10 and Kali Linux virtual machines.
- Implement Sysmon (System Monitor) to generate detailed Windows security logs for endpoint visibility.
- Forward Windows event logs into Splunk SIEM for centralized monitoring, search, and alerting.
- Analyze security telemetry to detect and investigate suspicious activity in a simulated SOC environment.
You Should Know
- Building the Virtual Lab Foundation – VirtualBox and VM Configuration
The first step in creating a cybersecurity home lab is establishing a robust virtualization foundation. Oracle VirtualBox provides a free, cross-platform hypervisor that enables you to run multiple operating systems simultaneously on a single physical machine. For this lab, you will need two primary virtual machines: a Windows 10 VM to serve as the “victim” or target system, and a Kali Linux VM to act as the attacker machine.
Step‑by‑step guide:
- Download and install Oracle VirtualBox from the official website. Ensure that hardware virtualization (VT-x/AMD-V) is enabled in your system BIOS.
2. Create the Windows 10 VM:
- Allocate at least 4 GB of RAM and 50 GB of dynamic storage.
- Install Windows 10 Pro or Enterprise (evaluation versions are available from Microsoft).
- During installation, choose a custom network setting—we will use a Host‑Only or Internal Network adapter to keep the lab isolated from your host network and the internet.
3. Create the Kali Linux VM:
- Download the Kali Linux ISO from the official Kali website.
- Allocate 2–4 GB of RAM and 30 GB of storage.
- Install Kali with default settings, and configure its network adapter to the same isolated network as the Windows VM.
- Verify connectivity: After both VMs are running, test that they can ping each other. On Windows, open Command Prompt and run
ping <Kali_IP>; on Kali, useping <Windows_IP>. This confirms that your isolated lab network is functional.
Key configuration tip: Use the Host‑Only adapter in VirtualBox to create a private network that is not accessible from your physical host or the internet. This prevents accidental exposure of your lab activities and keeps your host system secure.
- Installing and Configuring Sysmon for Deep Windows Event Logging
Windows Event Logging provides a wealth of security data, but the default logs are often insufficient for detailed threat hunting. Sysmon (System Monitor) is a powerful Windows system service and device driver that logs detailed system activity to the Windows event log, including process creation, network connections, and file creation times. It is an essential tool for endpoint detection and response (EDR) and SIEM integration.
Step‑by‑step guide:
1. Download Sysmon from the Microsoft Sysinternals website.
- Extract the ZIP file to a folder on your Windows 10 VM (e.g.,
C:\Sysmon). - Create a Sysmon configuration file (e.g.,
sysmon-config.xml) that defines which events to log. A well-known configuration from SwiftOnSecurity is widely used and provides comprehensive coverage. You can download it directly:Invoke-WebRequest -Uri "https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml" -OutFile "C:\Sysmon\sysmon-config.xml"
- Install Sysmon with the configuration file. Open an elevated Command Prompt or PowerShell and run:
C:\Sysmon\Sysmon64.exe -accepteula -i C:\Sysmon\sysmon-config.xml
- Verify installation: Check that Sysmon is running by opening Event Viewer (
eventvwr.msc) and navigating to Applications and Services Logs → Microsoft → Windows → Sysmon → Operational. You should see events being generated as you perform actions on the system. - Test event generation: Perform a few basic actions—open Notepad, create a text file, or browse a website. Then refresh the Sysmon log in Event Viewer to confirm that events such as process creation (Event ID 1) and network connections (Event ID 3) are being recorded.
Pro tip: Sysmon events are rich with detail. Event ID 1 (Process Creation) captures the command line of every process, which is invaluable for detecting malicious scripts or unusual command-line arguments. Event ID 3 (Network Connection) logs source and destination IPs and ports, helping you identify beaconing or data exfiltration attempts.
- Setting Up Splunk SIEM for Log Aggregation and Analysis
Splunk is a leading SIEM platform that ingests machine data from various sources, indexes it, and enables powerful search, analysis, and visualization. In this lab, Splunk will serve as the central log repository where Windows Sysmon events are forwarded for monitoring and correlation.
Step‑by‑step guide:
- Download and install Splunk Enterprise on your Windows 10 VM (or a separate dedicated VM if resources allow). You can use the free 500 MB/day license, which is sufficient for a home lab.
– Visit the Splunk download page and select the Windows version.
– Run the installer and follow the default settings. Choose to start Splunk as a service.
2. Access the Splunk web interface at http://localhost:8000` (or the IP of your Splunk server). Log in with the admin credentials you set during installation.main
3. Install the Splunk Universal Forwarder on the Windows 10 VM (if Splunk is installed on a different machine) to forward logs to the Splunk indexer. Alternatively, if Splunk is installed locally, you can configure inputs directly.
4. Configure a Windows Event Log input in Splunk:
- In Splunk Web, go to Settings → Data Inputs → Windows Event Log.
- Click New and select the log sources you want to monitor. At a minimum, include Security, System, and Sysmon Operational.
- Specify the index (e.g.,) and set a sourcetype (e.g.,WinEventLog`).
5. Verify data ingestion: After a few minutes, run a search in Splunk: `index=main sourcetype=WinEventLog` or `index=main EventCode=1` to see Sysmon process creation events. If you see results, your forwarding pipeline is working correctly.
Troubleshooting tip: If no events appear, check that the Splunk Forwarder service is running and that the Windows Event Log service is active. Also, ensure that the Splunk indexer is listening on the correct port (default 9997 for TCP forwarding).
- Simulating an Attack with Kali Linux and Generating Security Events
With the lab infrastructure in place, it is time to simulate a real-world attack scenario. Kali Linux comes preloaded with hundreds of penetration testing tools. For this exercise, we will simulate a simple network scan and a brute-force attack to generate security events that can be detected in Splunk.
Step‑by‑step guide:
- Perform a network scan from Kali to discover the Windows VM. Use Nmap to scan for open ports and services:
nmap -sV -p- <Windows_IP>
This will generate network connection events (Sysmon Event ID 3) on the Windows VM, as well as Security Event ID 5156 (Windows Filtering Platform connection) if auditing is enabled.
- Simulate a brute‑force attack against the Windows VM’s SMB or RDP service. For example, use Hydra to perform a dictionary attack on SMB:
hydra -l administrator -P /usr/share/wordlists/rockyou.txt smb://<Windows_IP>
This will generate numerous failed login attempts, which are logged as Security Event ID 4625 (failed logon) on the Windows system.
- Observe the logs in Splunk: Run searches for `EventCode=4625` (failed logons) and `EventCode=3` (network connections) to see the attack activity. You can also create a dashboard or alert to notify you when a threshold of failed logins is exceeded within a short time window.
- Explore further attacks: Try generating a malicious PowerShell script or using Metasploit to simulate a more sophisticated exploit. Each action will produce a unique set of Sysmon and Windows Security events that you can correlate in Splunk.
Learning point: This exercise demonstrates how a SOC analyst would use SIEM to detect an ongoing attack. The combination of network connection events and failed login attempts is a strong indicator of a brute-force or password-spraying campaign.
5. Creating Custom Alerts and Dashboards in Splunk
A SIEM is only as useful as the alerts and visualizations it provides. Splunk allows you to create custom searches, alerts, and dashboards that can notify you of suspicious activity in real time.
Step‑by‑step guide:
- Create a saved search for detecting brute-force attacks:
– Go to Search & Reporting and enter:
index=main EventCode=4625 | stats count by Account_Name, Source_Network_Address | where count > 5
– This search counts failed logon attempts per user account and source IP, highlighting accounts with more than 5 failures.
2. Schedule the search as an alert:
- Click Save As → Alert.
- Set the schedule to run every 5 minutes.
- Choose a trigger condition (e.g., if the search returns more than 0 results).
- Configure an action, such as sending an email or writing to a log file.
- Build a simple dashboard to visualize security events:
– In Splunk, create a new dashboard and add panels for:
– Top 10 source IPs generating network connections.
– Failed logon events over time (a timechart).
– Sysmon process creation events by process name.
– Use the built-in visualization options (bar charts, line graphs, tables) to make the data accessible at a glance.
4. Test your alerts: Run the Nmap scan or Hydra attack again and verify that your alert triggers within the scheduled window.
Pro tip: For a more advanced setup, consider using Splunk’s Enterprise Security app, which provides pre-built correlation searches and threat intelligence feeds. However, for a home lab, the core Splunk platform with custom searches is more than sufficient.
- Linux and Windows Commands for Lab Maintenance and Troubleshooting
Maintaining a stable lab environment requires familiarity with both Windows and Linux command-line tools. Below is a curated list of commands that will help you manage your VMs, troubleshoot connectivity, and verify log forwarding.
Windows Commands (run as Administrator):
- Check network configuration: `ipconfig /all`
– Test connectivity to Kali: `ping`
– View Windows Event Logs: `wevtutil qe System /c:5 /rd:true` (last 5 System events) - Restart the Sysmon service: `sc stop Sysmon && sc start Sysmon`
– Verify Sysmon is running: `sc query Sysmon`
– Check Splunk Forwarder status: `sc query SplunkForwarder`
Linux Commands (on Kali):
- Check IP address: `ip a` or `ifconfig`
– Test connectivity to Windows: `ping`
– Scan for open ports: `nmap -sS`
– View system logs: `journalctl -xe` or `dmesg | tail`
– Restart networking: `sudo systemctl restart networking`
– Check service status: `sudo systemctl status ssh`
Troubleshooting common issues:
- VMs cannot ping each other: Ensure both VMs are using the same Host‑Only adapter and that the adapter is enabled in VirtualBox settings.
- Splunk not receiving events: Verify that the Splunk Universal Forwarder is configured with the correct indexer IP and port. Check the forwarder logs at
C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log. - Sysmon not logging: Confirm that Sysmon is installed correctly and that the configuration file is valid. Run `Sysmon64.exe -c` to view the current configuration.
What Undercode Say
- Key Takeaway 1: A home lab is the single most effective way to transition from cybersecurity theory to practical, job‑ready skills. By simulating both attack and defense, you internalize the tactics, techniques, and procedures (TTPs) used by adversaries while learning how to detect and respond to them using industry‑standard tools like Splunk and Sysmon.
- Key Takeaway 2: The combination of open-source and free tools—VirtualBox, Kali Linux, Sysmon, and Splunk Free—makes this lab accessible to anyone with a modest computer and a willingness to learn. There is no need for expensive hardware or commercial licenses to gain meaningful SOC experience.
Analysis: The post highlights a growing trend in cybersecurity education: the shift from passive learning (watching videos, reading books) to active, project-based skill development. Building a home lab not only reinforces technical concepts but also teaches valuable troubleshooting and system administration skills that are often overlooked in traditional courses. The mention of the MYDFIR YouTube channel underscores the importance of community-driven content in democratizing cybersecurity knowledge. As more professionals share their lab setups and walkthroughs, the barrier to entry continues to fall, enabling a new generation of analysts to enter the field with practical experience already under their belts.
Prediction
- +1: The home lab approach will become a standard prerequisite for entry-level SOC analyst roles within the next 3–5 years. Employers are increasingly valuing demonstrable skills over certifications alone, and a well-documented home lab project on a portfolio or LinkedIn profile will serve as a powerful differentiator in the job market.
- +1: As cloud-based lab environments (e.g., AWS, Azure, or dedicated cybersecurity training platforms) become more affordable, we will see a hybrid model where beginners start with local virtual machines and gradually migrate to cloud-hosted labs for scalability and collaboration. This will enable more complex scenarios, such as simulating multi‑site enterprise networks and cloud-1ative attacks.
- -1: However, the reliance on free tools and community configurations may lead to a false sense of security if not complemented with a deep understanding of the underlying operating system and network protocols. Lab exercises that are purely “paint‑by‑numbers” without critical thinking risk producing analysts who can follow guides but struggle to adapt to novel threats.
- -1: There is also a risk of lab environments being misconfigured and accidentally exposed to the internet, leading to real-world compromises. Practitioners must be vigilant about network isolation and regularly audit their lab configurations to prevent unintended data leaks or system breaches.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Pratik Kir – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
