EDR Detection Lab

A hands-on lab for endpoint detection using Sysmon, Splunk, and attack simulation.

What This Is

A detection pipeline I built to learn how endpoint telemetry works in practice:

┌─────────────┐      ┌─────────────┐      ┌─────────────┐
│  Attacker   │ ───► │  Windows    │ ───► │   Splunk    │
│  (Kali)     │      │  + Sysmon   │      │   (SIEM)    │
└─────────────┘      └─────────────┘      └─────────────┘
     Attack              Logs              Detection

Run attacks. See what logs they generate. Write rules to catch them.

Stack

Component	Purpose
Windows 10 VM	Target endpoint
Sysmon	Endpoint telemetry
Splunk	Log aggregation + detection
Atomic Red Team	Attack simulation

Current Progress

• Sysmon deployment with SwiftOnSecurity config
• Splunk Universal Forwarder setup
• Log ingestion and parsing
• Attack simulations (Mimikatz, Kerberoasting)
• Detection rules with MITRE ATT&CK mapping

Quick Start

See SETUP.md for full installation steps and troubleshooting.

Planned Detections

MITRE ID	Technique	Status
T1003.001	LSASS Memory Dump	Done
T1558.003	Kerberoasting	Planned
T1021.001	RDP Lateral Movement	Planned

Structure

edr-detection-lab/
├── README.md
├── SETUP.md           # Installation guide + lessons learned
└── detections/        # Detection rules with evidence
    └── T1003.001-lsass-dump/

Why I Built This

I wanted to understand detection engineering from the ground up — not just run tools, but know why alerts fire and how to tune them. This lab is my sandbox for that.

Resources

• SwiftOnSecurity/sysmon-config
• Atomic Red Team
• MITRE ATT&CK

Author

Arda Fidancı
Cybersecurity student focused on Blue Team and SOC operations.