// Hands-on security labs

CYBERLABS

Six production-grade labs built from real SOC experience, project work, and the MITRE ATT&CK framework. Each includes runnable Python scripts, guided exercises, and a challenge extension.

7
Labs
35+
Exercises
7
Python scripts
15+
ATT&CK techniques
[ 00 ]

Lab Overview

// LAB-01
Detection Engineering
Write Sigma rules, validate MITRE ATT&CK tags, convert to Splunk SPL and Sentinel KQL, and simulate CI/CD deployment.
SigmaSplunkSentinelMITRE ATT&CK
Difficulty:
Intermediate
Exercises
  • Author a Mimikatz detection Sigma rule
  • Validate ATT&CK technique tags
  • Convert to SPL and KQL
  • Simulate SIEM deployment
  • Challenge: write your own rule
// LAB-02
Cloud Security Audit
Audit a simulated AWS environment against CIS Benchmark v1.5. Score findings by risk and build a phased remediation plan.
AWSCIS BenchmarkIAMS3
Difficulty:
Intermediate
Exercises
  • Inspect mock AWS environment
  • Run CIS Benchmark audit checks
  • Apply risk scoring with env multipliers
  • Generate remediation roadmap
  • Challenge: find 3 hidden findings
// LAB-03
Threat Hunting
Hunt for 8 embedded attacker TTPs in 500 simulated Windows/Sysmon log events using hypothesis-driven queries aligned to ATT&CK.
Splunk SPLMITRE ATT&CKUEBASysmon
Difficulty:
Advanced
Exercises
  • Generate 500-event log dataset with 8 TTPs
  • Run 6 ATT&CK-mapped hypotheses
  • Measure precision & recall per hunt
  • Behavioral analytics for brute force
  • Reconstruct attacker timeline
// LAB-04
DFIR Investigation
Analyze forensic artifacts from a compromised endpoint. Extract IOCs, map to ATT&CK, reconstruct the timeline, and write a formal IR report.
ForensicsPrefetchEvent LogsIOCs
Difficulty:
Advanced
Exercises
  • Analyze prefetch files & event logs
  • Extract IOCs (IPs, hashes, registry)
  • Map 9 ATT&CK techniques to evidence
  • Build chronological attack timeline
  • Write executive IR report
// LAB-05
Phishing Analysis & IR
Analyze 3 phishing emails (credential harvesting, malware delivery, BEC). Extract IOCs, classify campaigns, and trigger automated response actions.
SPF/DKIM/DMARCURL AnalysisBECFastAPI
Difficulty:
Intermediate
Exercises
  • Analyze email authentication headers
  • Extract URLs, hashes, encoded strings
  • Score threat severity (0–100)
  • Classify campaign type (BEC / cred / malware)
  • Trigger automated response playbook
// LAB-06
Penetration Testing
Follow PTES against a Metasploitable 2 topology. Recon, enumerate 13 services, simulate 7 CVE exploits, post-exploit, and write a professional pentest report.
MetasploitNmap7 CVEsPTES
Difficulty:
Expert
Exercises
  • Simulated Nmap recon (13 open ports)
  • Service enumeration & default cred checks
  • Simulated exploitation (vsftpd, Samba, IRC)
  • Post-exploitation enumeration
  • Professional pentest report
// LAB-07
Zero Trust & Network Security
Design a 3-VLAN Zero Trust lab. Build a policy engine, analyze mTLS certificate design, simulate 6 lateral movement attacks, and score your ZT maturity against NIST SP 800-207.
Zero TrustmTLSNIST 800-207Microseg
Difficulty:
Advanced
Exercises
  • Design 3-VLAN Zero Trust topology
  • Build default-deny policy engine
  • Analyze mTLS cert design (TTL, algo)
  • Simulate 6 lateral movement attacks
  • Score ZT maturity (CISA model)
LAB-01 // DETECTION ENGINEERING

Detection-as-Code — Sigma Rule Pipeline

Write a production Sigma rule for Mimikatz detection, validate ATT&CK tagging, convert to Splunk SPL and Sentinel KQL, then simulate automated CI/CD deployment to both SIEMs.

$ python lab1_detection_engineering.py
// EXERCISE 1
Write a Sigma Rule
Author a Sigma YAML rule targeting Mimikatz T1003.001 (LSASS credential dump). Include logsource, detection with multiple selections, and proper tags for tactic + technique. The script saves it to lab1_output/mimikatz_detection.yml.
// EXERCISE 2
ATT&CK Tag Validation
Run the validator against your rule. It checks required fields (title, description, detection, level), verifies all attack.tXXXX technique IDs exist, confirms at least one tactic tag, and validates severity level. Fails CI if any check fails.
// EXERCISE 3
Convert to Splunk SPL
The converter reads your Sigma YAML and maps field modifiers (|contains, |endswith) to SPL equivalents (field="*value*"). Output is a fully runnable saved search with index=windows scope, table projection, and sort. Saved to lab1_output/mimikatz_detection.spl.
// EXERCISE 4
Convert to Sentinel KQL
Same rule converted to KQL for Microsoft Sentinel. Field modifiers map to KQL operators (contains, endswith). Output targets DeviceProcessEvents table with where TimeGenerated >= ago(1h) windowing. Saved to lab1_output/mimikatz_detection.kql.
⚡ Challenge: Write Your Own Rule
Edit lab1_output/YOUR_RULE_challenge.yml and write a detection for one of: T1078 (Valid Accounts — impossible travel), T1190 (Exploit Public-Facing App — web shell upload), or T1071.004 (DNS C2 beaconing). Validate it passes all checks, then convert to both SIEM targets.
# Sample generated Splunk SPL output
index=windows EventCode=4688 OR EventCode=1
| search (Image="*\mimikatz.exe" OR Image="*\mimilib.dll")
       OR (CommandLine="*privilege::debug*"
           OR CommandLine="*sekurlsa::logonpasswords*"
           OR CommandLine="*lsadump::sam*")
| table _time, host, user, CommandLine, Image, ParentImage
| sort -_time
LAB-02 // CLOUD SECURITY

CIS Benchmark — AWS Misconfiguration Audit

Audit a simulated production AWS account across IAM, S3, security groups, and CloudTrail against 18 CIS AWS Foundations Benchmark v1.5 controls. Score every finding and build a phased remediation plan.

$ python lab2_cloud_security_audit.py
// EXERCISE 1
Inspect the Mock AWS Environment
The mock environment contains a production account with intentional misconfigurations: root MFA disabled, users without MFA, a wildcard IAM policy (Action:* Resource:*), a public S3 bucket, SSH/RDP open security groups, and a single-region CloudTrail without log validation.
// EXERCISE 2
CIS Benchmark Audit
Four audit modules run in sequence: audit_iam() (5 checks), audit_s3() (15 checks across 4 buckets), audit_security_groups() (checks all 5 SGs for dangerous ports and all-traffic rules), and audit_cloudtrail() (2 checks). Each finding maps to a CIS control reference.
// EXERCISE 3
Risk Scoring
Every finding gets a numeric risk score: base_severity × category_weight × env_multiplier. Production accounts multiply by 1.5×. IAM and S3 categories carry a 1.2–1.3× category weight because they directly expose data. A Critical IAM finding in prod scores up to 10.0 × 1.3 × 1.5 = 19.5.
// EXERCISE 4
Remediation Planning
Findings are bucketed into 4 phases: IMMEDIATE (Critical — patch within 24h), THIS WEEK (High), THIS MONTH (Medium), and BACKLOG (Low). Each item includes a specific remediation action with effort estimate. The plan is saved as JSON for Jira import or Notion tracking.
⚡ Challenge: Find the 3 Hidden Findings
Replace MOCK_AWS_ENV with CHALLENGE_ENV in run_lab() and re-run. Three additional findings are embedded: a CloudTrail log bucket with public access, an additional user with a wildcard IAM policy, and a service account with an over-privileged inline policy. Can you find all three?
LAB-03 // THREAT HUNTING

Hypothesis-Driven — Hunt for Hidden TTPs

Hunt for 8 embedded attacker TTPs across 500 simulated Windows Security and Sysmon log events. Six ATT&CK-aligned hypotheses. Measure precision, recall, and false positive rate for each hunt query.

$ python lab3_threat_hunting.py
HypothesisATT&CKWhat to HuntPrecision Target
H-01T1059.001PowerShell -enc / -ExecutionPolicy BypassTune to >90%
H-02T1003.001LSASS dump: comsvcs.dll MiniDump / procdump100% (no FP)
H-03T1021.002PsExec / PaExec lateral movement100% (no FP)
H-04T1053.005schtasks.exe /create command100% (no FP)
H-05T1110EventID 4625 count > 3 per user in 5min>80%
H-06T1048.001DNS query length >40 chars (tunneling)Tune threshold
⚡ Challenge: Eliminate False Positives in H-01
H-01 (PowerShell detection) hits legitimate PowerShell usage in addition to attacker activity, giving you false positives and a precision below 100%. Add parent process checking (ParentImage not in (trusted list)) and working directory constraints to the hypothesis query to eliminate FPs without missing the true positive. Target: precision = 100%.
LAB-04 // DFIR

Forensic Investigation — Breach on WS-BOB-02

A host is compromised. Analyze Prefetch files, Windows Event Logs, registry keys, network connections, and file hashes to reconstruct the full attack chain, extract IOCs, and write an executive IR report.

$ python lab4_dfir.py
TechniqueTacticEvidence Source
T1566.001Initial AccessOutlook.exe prefetch + timing correlation
T1059.001ExecutionEventID 4688: powershell.exe -nop -enc SQBFAFg...
T1003.001Credential AccessEventID 4688: rundll32.exe comsvcs.dll MiniDump + lsass.dmp file
T1134.001Priv Escalationmimikatz.exe prefetch + EventID 4688 with privilege::debug
T1021.002Lateral MovementPsExec64.exe prefetch + EventID 4624 logon type 3 on SRV-DC-01
T1053.005PersistenceEventID 4688: schtasks /create /tn WindowsUpdate + EventID 4698
T1547.001PersistenceRegistry: HKCU\...\Run\WindowsUpdate = C:\Temp\payload.exe
T1071.001C2Network: SRV-DC-01 → 185.220.101.47:443 (HTTPS beacon)
T1048.001ExfiltrationNetwork: SRV-DC-01 → 185.220.101.47:53, 32KB DNS traffic
⚡ Challenge: Calculate Dwell Time
Dwell time = time from initial compromise to detection. Add a calculate_dwell_time(timeline) function that finds the earliest suspicious event and the first detection event (first EventID 4625 failure that triggered investigation). Append the dwell time to the executive summary in the IR report.
LAB-05 // PHISHING ANALYSIS

Email Forensics — 3 Phishing Campaigns

Triage 3 phishing emails: a Microsoft 365 credential harvest, a macro-dropper invoice, and a BEC wire fraud. Analyze headers, extract IOCs, classify campaigns, and trigger automated response playbooks.

$ python lab5_phishing_analysis.py
// EMAIL-001
Credential Harvesting — M365 Lure
Sender: security-alert@micros0ft-verify.com. SPF FAIL, DKIM NONE, DMARC FAIL. Body contains a lookalike login URL with base64-encoded user token. Reply-To redirects to .ru domain. Classification: CREDENTIAL_HARVESTING. Score: 85/100 (CRITICAL).
// EMAIL-002
Malware Delivery — Invoice Lure
Attachment: Invoice_INV20250315.doc (MD5 matches known Emotet macro dropper). Sender domain spoofs a legitimate vendor with .evil.ru suffix. SPF SOFTFAIL. Score: 90/100 (CRITICAL). Response: endpoint hash hunt triggered across fleet.
// EMAIL-003
BEC Wire Fraud — CEO Impersonation
Sender spoofs CEO with .phishing-domains.xyz. Requests $127,500 wire transfer "urgently." Bank account number extracted (4532015112830366). Reply-To redirects to attacker Gmail. Score: 95/100 (CRITICAL). Finance team alert fired immediately.
// EXERCISE 5
Automated Response Playbook
For each email: quarantine email → block sender domain → block malicious IPs at firewall → block URLs at proxy → trigger endpoint hash hunt (malware only) → alert finance (BEC only) → notify recipient with awareness tip. All actions logged with timestamps for audit trail.
⚡ Challenge: DKIM Signature Validation
Add a verify_dkim(email) function that parses the DKIM-Signature header (if present), extracts the bh (body hash) field, independently computes SHA-256(canonicalized_body), and compares. If they don't match, the email has been tampered with in transit.
LAB-06 // PENETRATION TESTING

PTES — Metasploitable 2 Full Kill Chain

Follow the Penetration Testing Execution Standard against a Metasploitable 2 topology. Recon 13 open services, simulate 7 CVE exploits, post-exploit to harvest credentials, and deliver a professional pentest report. Run against your live VM for real hands-on practice.

$ python lab6_penetration_testing.py
CVECVSSPort / ServiceResult
CVE-2011-252310.021 — vsftpd 2.3.4Root shell via backdoor on :6200
CVE-2007-244710.0445 — Samba MS-RPCRoot shell via usermap_script
CVE-2010-207510.06667 — UnrealIRCdRoot shell via IRC backdoor
CVE-2004-26879.33632 — distccddaemon shell → sudo root
CVE-2007-32809.05432 — PostgreSQLMeterpreter as postgres
CVE-2009-35487.58180 — TomcatShell via default creds + WAR upload
N/A8.880 — DVWAFull DB dump via SQLmap
⚡ Live Lab: Point at Metasploitable 2 (10.56.237.233)
Open msfconsole and run the actual modules shown in Exercise 3. Challenge: exploit distccd (port 3632) and escalate to root using the sudo -l finding from post-exploitation. Document each step in the findings report template at lab6_output/pentest_report_metasploitable2.txt.
LAB-07 // ZERO TRUST & NETWORK SECURITY

Zero Trust Architecture — Design, Enforce & Validate

Design a 3-VLAN Zero Trust network lab (Dev / Prod / Management). Build a default-deny policy engine that enforces mTLS and identity for every flow. Simulate 6 attacker lateral movement scenarios and score your architecture against NIST SP 800-207 and the CISA Zero Trust Maturity Model.

$ python lab7_zero_trust_network.py
// EXERCISE 1
Zero Trust Topology Design
Model three network zones: VLAN_10_DEV (trust=low), VLAN_20_PROD (trust=high), and VLAN_30_MGMT (trust=critical). Each zone has a defined subnet and host roster. The key principle: no zone implicitly trusts any other — even prod-web-01 cannot reach prod-db-01 without an explicit policy.
// EXERCISE 2
Default-Deny Policy Engine
Six explicit ALLOW policies are defined. Every other flow hits the default DENY. Each policy enforces: source zone/host, destination, port, whether mTLS cert is required, and which service identity must be presented. The engine evaluates all conditions in sequence and logs every decision for audit.
// EXERCISE 3
mTLS Certificate Design Review
The lab analyzes your PKI design: CA key algorithm (ECDSA P-384), service cert TTL (all ≤24h), identity cert TTL for humans (≤8h), and MFA requirement for human certs. Short-lived certs reduce blast radius if a cert is stolen — the attacker's window is capped at the TTL.
// EXERCISE 4
Lateral Movement Simulation
Six attack scenarios test your policy engine. Notably: an attacker who steals the svc-web cert still gets DENIED when trying to hit the database — because the DB policy requires identity=svc-app, not svc-web. Identity-aware policies stop credential theft from enabling lateral movement.
ScenarioAttacker HasTargetResult
Direct Dev → Prod DBFoothold on dev-ws-01prod-db-01:5432DENY — no policy
Dev → Prod Web HTTPDeveloper identityprod-web-01:80DENY — no policy
Dev → SIEM (log replay)Valid mTLS certmgmt-siem:514DENY — wrong src zone
Stolen svc-web → DBsvc-web cert (stolen)prod-db-01:5432DENY — identity mismatch
Legitimate app → DBsvc-app cert + identityprod-db-01:5432ALLOW ✓
Bastion → Prod SSHops-engineer + MFA certany prod:22ALLOW ✓
⚡ Challenge 1: Push ZT Score to 100%
The current architecture scores 92.9% — the missing check is OCSP stapling for certificate revocation. Add an ocsp_stapling_enabled flag to the cert inventory and update ZT_PRINCIPLES to check it. Re-run to hit 100% maturity.
⚡ Challenge 2: JWT Replay Attack
Add a 7th lateral movement scenario where the attacker replays a captured JWT token (no mTLS cert) to access prod-app-01. The policy engine should deny it because mTLS cert is required. Then add a token_exp_minutes field and show how a 15-minute expiry window limits the attack surface even if the token is captured.