🛡️ Active Directory Home Lab

The goal is to understand how attacks happen, how data flows across a network, and how to detect threats using a SIEM solution (Splunk). This lab covers everything from setting up Active Directory and a Domain Controller to launching a Brute Force attack and detecting it through log analysis.

---

🎯 Objectives

• Understand how data flows across a network
• Understand how the pieces of a corporate environment connect together
• Gain confidence working with enterprise tools (Active Directory, Splunk, Sysmon)
• Learn to draw network diagrams using draw.io
• Simulate real attacks and detect them as a SOC Analyst

---

🖥️ Architecture / Network Topology

Network Components:

Component	Role
Windows Server 2022	Active Directory Domain Controller (ADDC01)
Windows 10	Target Machine (jenny smith / tsmith)
Kali Linux	Attacker Machine
Ubuntu Server	Splunk SIEM
Virtual Switch	NAT Network (project-ad) via VirtualBox

---

⚙️ Requirements

Resource	Minimum
RAM	16 GB
Storage	256 GB SSD
Virtualization	VirtualBox

Virtual Machines:

• Windows Server 2022 (Active Directory + Domain Controller)
• Windows 10 (Target Machine)
• Kali Linux (Attacker Machine)
• Ubuntu Server (Splunk)

---

🛠️ Tools Used

Tool	Purpose
Active Directory Domain Services (ADDS)	User, group, and computer management
Splunk	SIEM — log collection, indexing, and threat detection
Splunk Universal Forwarder	Forwards Windows event logs to Splunk
Sysmon	Advanced Windows event logging (process creation, network connections, etc.)
Olaf Sysmon Config	Pre-built Sysmon configuration for maximum visibility
Kali Linux	Attacker machine — Brute Force simulation
Crowbar	RDP Brute Force tool
Hydra	Alternative Brute Force tool (used for RDP attack)
Atomic Red Team	Simulate MITRE ATT&CK techniques on the target machine
draw.io	Network topology diagram

---

🚀 Setup Guide

Part 1 — VirtualBox Network Setup

1. Open VirtualBox → File → Preferences → Network
2. Add a new NAT Network and name it project-ad
3. Configure all 4 VMs to use this NAT Network in their settings
4. This allows all machines to communicate with each other and reach the internet

---

Part 2 — Splunk Server (Ubuntu)

Set a Static IP (required so machines can always reach Splunk):

sudo nano /etc/netplan/00-installer-config.yaml

Configure it with a static IP (e.g., 192.168.10.10), then apply:

sudo netplan apply

Install Splunk:

1. Download Splunk Enterprise from splunk.com
2. Install and start the Splunk service
3. Access the Splunk web interface at http://192.168.10.10:8000
4. Enable receiving on port 9997: Settings → Forwarding and Receiving → Configure Receiving

---

Part 3 — Active Directory + Domain Controller

1. Install Active Directory Domain Services (ADDS) role on Windows Server
2. Promote the server to a Domain Controller
3. Create a new forest/domain (e.g., myserver.local)
4. Create two users in Active Directory (e.g., jsmith, tsmith)

---

Part 4 — Splunk Universal Forwarder + Sysmon (Windows Machines)

Do this on both the Windows 10 Target Machine and the Windows Server:

Step 1 — Download and install:

• Splunk Universal Forwarder
• Sysmon
• Olaf Sysmon Configuration

Step 2 — Install Sysmon with Olaf config:

# Extract sysmon.zip, open PowerShell as Administrator in that folder
.\Sysmon64.exe -i ..\sysmonconfig.xml

Step 3 — Configure the Splunk Forwarder:

Open Notepad as Administrator and create the inputs config:

[WinEventLog://Application]
index = endpoint
disabled = false

[WinEventLog://Security]
index = endpoint
disabled = false

[WinEventLog://System]
index = endpoint
disabled = false

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
index = endpoint
disabled = false
renderXml = true
source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

Save to:

C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf

Step 4 — Point forwarder to Splunk server:

During installation, set the forwarding address to:

192.168.10.10:9997

Step 5 — Fix permissions:

Open services.msc as Administrator → find SplunkForwarder → Properties → Log On → change to Local System account. Restart the service.

Step 6 — Verify in Splunk:

Search in Splunk:

index=endpoint

You should see 2 hosts: ADDC01 and target-pc

---

Part 5 — Kali Linux Setup

Set a Static IP:

1. Click the network icon → Edit Connections → Edit your Ethernet connection
2. Go to IPv4 Settings → Method: Manual
3. Add your static IP (e.g., 192.168.10.250), Gateway, and DNS

Install Crowbar (RDP Brute Force tool):

sudo apt-get install -y crowbar

Prepare the wordlist:

cd /usr/share/wordlists/
sudo gunzip rockyou.txt.gz
cp rockyou.txt /home/kali/Desktop/AD-Project/
cd /home/kali/Desktop/AD-Project/
head -n 20 rockyou.txt > passwords.txt

# Then open passwords.txt and manually add the actual target password
mousepad passwords.txt

---

Part 6 — Enable RDP on Target Machine

On the Windows 10 Target Machine:

1. Right-click This PC → Properties
2. Sign in as Administrator
3. Remote Desktop → Enable Remote Desktop
4. Click Select users that can remotely access this PC
5. Add jsmith and tsmith

---

Part 7 — Brute Force Attack Simulation

From Kali Linux, run the attack against the target machine:

hydra -l tsmith -P passwords.txt rdp://192.168.10.100

This attempts to log in as tsmith using every password in the list via RDP.

---

Part 8 — Detection in Splunk

After the attack, go to Splunk and narrow the search to the timeframe of the attack.

Search for failed login attempts (evidence of Brute Force):

index=endpoint tsmith EventCode=4625

You will see dozens of events all within the same minute — a clear Indicator of Compromise (IOC) for Brute Force.

Search for the successful login (evidence of compromise):

index=endpoint tsmith EventCode=4624

Check the Workstation Name field — you will see it came from Kali.

Confirm it was from Kali:

index=endpoint tsmith EventCode=4625 kali

SOC Analyst Timeline:

Event	Meaning
Multiple EventCode=4625 from 192.168.10.250	Brute Force attempts via RDP
EventCode=4624 — Logon Type: 10	Successful RDP login
Workstation: kali	Confirmed attacker machine

Conclusion: Possible RDP Brute Force attack followed by successful compromise.

---

Part 9 — Atomic Red Team (MITRE ATT&CK Simulation)

Atomic Red Team lets you simulate real attack techniques from the MITRE ATT&CK framework on the target machine and then detect them in Splunk.

Installation (on Windows 10 Target Machine):

Open PowerShell as Administrator:

# Bypass execution policy for this session
Set-ExecutionPolicy Bypass -Scope CurrentUser

# Install Atomic Red Team
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)
Install-AtomicRedTeam -getAtomics

Running a technique:

Look up a technique on MITRE ATT&CK (e.g., T1136 — Create Account).

# Run a specific technique by its MITRE ID
Invoke-AtomicTest T1136.001

Detecting it in Splunk:

After running a technique, go to Splunk and search:

index=endpoint

Filter by the relevant Event ID or keyword from the MITRE technique page to find the generated logs. Each technique on attack.mitre.org describes what logs and Event IDs it generates — use that to build your Splunk query.

Example — T1136 (Create Local Account):

index=endpoint EventCode=4720

EventCode 4720 = A user account was created. This fires every time Atomic Red Team runs T1136.001.

---

📋 Key Event IDs Reference

Event ID	Meaning
4624	Successful Logon
4625	Failed Logon
4634	Logoff
4648	Logon using explicit credentials
4720	User account created
4768 / 4769	Kerberos Authentication (Domain Controller)
4776	Credential Validation
5379	Credential Manager access

---

👨‍💻 Author

Laith Hatem / layshatem5