April 2025 - May 2025 done a lab Purple team project using ElasticSearch stack: *The lab was designed to…
Vitalii Bibikov — SOC Analyst, Blue team, Purple team, Incident Response, Inestigation
April 2025 - May 2025 done a lab Purple team project using ElasticSearch stack:
*The lab was designed to emulate real-world attack scenarios and a realistic Security Operations Center (SOC) environment using modern security tools and technologies. The primary objective was to gain hands-on experience from a Purple Team perspective, combining offensive (Red Team) and defensive (Blue Team) methodologies, with a focus on detection engineering, attack simulation, and incident response.
The lab covers utilising and detecting following tactics:
1. Port Scan (Reconnaissance)
2. SMB Password Brute Force (Credential Access)
3. WMI Child Process Spawn (Execution)
4 PowerShell Execution & Registry Persistence
5 Data Exfiltration via HTTP (Exfiltration)
*
Tech stack: ElasticSearch, ElasticDefend, Windows Server 2025 (1 VM), Windows 10 (3 VMs), Active Directory, Sysmon, Kali Linux (for testing), Snort.
1 reactions · 0 comments