Active Directory + Wazuh Lab.
An independent Windows security monitoring lab for correlating authentication and PowerShell activity with Wazuh and Sysmon telemetry.
Overview
An independent lab built in 2026 to practice security monitoring and investigation in an isolated Windows Server and Active Directory environment. Wazuh collects Windows Security, Sysmon, PowerShell, and Kerberos telemetry for repeatable analysis.
Environment and approach
The isolated environment supports simulations of password spraying, Kerberoasting, and suspicious PowerShell activity. Investigation correlates event IDs 4769, 4771, and 4104 with Sysmon telemetry to examine observed behavior.
Detection work
Wazuh detection logic was developed and tested for PowerShell Invoke-Expression (IEX) activity. Alerts were validated in the lab and the observed behavior was mapped to MITRE ATT&CK T1059.001.
Evidence and limitations
Validation focused on collecting the configured telemetry, correlating the simulated activity, and checking the IEX detection alerts within the isolated lab. These observations are limited to that environment; they do not establish detection rates or production coverage.
Lab detections require evaluation against the relevant environment and expected administrative activity before broader use. A simulation and a mapped technique do not establish comprehensive coverage.