sovereignMediaLabV2/incident-response/incident-03 at main · Pat4rthur/sovereignMediaLabV2
Patrick Arthur — On a mission to become a SOC Analyst; bringing hands-on SIEM, IR, and compliance chops, plus a genuine belief that good security is built with good people.
Just published a new incident response simulation in my cybersecurity homelab: Cloud Workload Compromise & DNS Exfiltration Detection.
What was built:
AWS EC2 instance (attacker foothold) connected to an on‑prem Wazuh SIEM via Tailscale VPN
Simulated IAM user reconnaissance, email forwarding rule (WorkMail API), and dnscat2 DNS tunneling
Custom Wazuh rule (ID 100200) to detect DNS tunneling tools in real time
The full kill chain is documented as a formal incident response playbook with MITRE ATT&CK mapping, artifacts, and lessons learned.
Check out the incident in my homelab repo:
🔗 https://github.com/Pat4rthur/sovereignMediaLabV2/tree/main/incident-response/incident-03
#cybersecurity #soc #wazuh #aws #tailscale #detectionengineering #blueteam
1 reactions · 0 comments
Topics: #wazuh, #blueteam, #tailscale, #aws, #cybersecurity, #soc, #detectionengineering