Platform
Microsoft Azure
SIEM
Microsoft Sentinel
VM
Windows Server 2022
Hypervisor
VirtualBox
Attack Sim
Atomic Red Team
Framework
MITRE ATT&CK
// Architecture
Lab Architecture
┌─────────────────────────────────────────────────────────┐
│ HOME LAB (VirtualBox) │
│ │
│ Windows Server 2022 VM │
│ └── Sysmon (SwiftOnSecurity config) │
│ └── Microsoft Monitoring Agent (MMA) │
│ └── Atomic Red Team (attack simulation) │
│ │ │
└──────────────────────────┼──────────────────────────────┘
↓ logs via MMA
┌─────────────────────────────────────────────────────────┐
│ AZURE (Free Tier) │
│ │
│ Log Analytics Workspace (law-sentinel-homelab) │
│ └── Security Events (EventID 4625, 4624, etc.) │
│ └── Sysmon Events (process creation, network) │
│ └── Heartbeat (connectivity monitoring) │
│ │ │
│ Microsoft Sentinel │ │
│ └── KQL Analytics Rules │
│ └── Incident Detection │
│ └── MITRE ATT&CK Mapping │
└─────────────────────────────────────────────────────────┘
│ HOME LAB (VirtualBox) │
│ │
│ Windows Server 2022 VM │
│ └── Sysmon (SwiftOnSecurity config) │
│ └── Microsoft Monitoring Agent (MMA) │
│ └── Atomic Red Team (attack simulation) │
│ │ │
└──────────────────────────┼──────────────────────────────┘
↓ logs via MMA
┌─────────────────────────────────────────────────────────┐
│ AZURE (Free Tier) │
│ │
│ Log Analytics Workspace (law-sentinel-homelab) │
│ └── Security Events (EventID 4625, 4624, etc.) │
│ └── Sysmon Events (process creation, network) │
│ └── Heartbeat (connectivity monitoring) │
│ │ │
│ Microsoft Sentinel │ │
│ └── KQL Analytics Rules │
│ └── Incident Detection │
│ └── MITRE ATT&CK Mapping │
└─────────────────────────────────────────────────────────┘
// Build Walkthrough
Phase by Phase
PHASE 01
Azure Setup
Created the Azure environment and enabled Microsoft Sentinel on a free-tier subscription.
- Created a free Azure account at azure.microsoft.com/free using a personal Microsoft account
- Created resource group rg-sentinel-homelab in Australia East region
- Deployed a Log Analytics Workspace named law-sentinel-homelab — the data store for all logs
- Enabled Microsoft Sentinel on top of the workspace — the SIEM and analytics layer
- Set a $10 AUD monthly budget alert in Azure Cost Management to avoid surprise charges
PHASE 02
Windows VM + Sysmon + Agent
Built the on-premises target machine and connected it to Azure Sentinel.
- Downloaded Windows Server 2022 Evaluation ISO (180-day free trial) from Microsoft Evaluation Center
- Created a VM in VirtualBox named SentinelTarget-VM with 4GB RAM, 2 CPUs, 60GB disk
- Installed Windows Server 2022 (Desktop Experience) via the installer wizard
- Installed Sysmon v15.20 using the SwiftOnSecurity community config — captures process creation, network connections, and file events beyond standard Windows logging
- Installed the Microsoft Monitoring Agent (MMA) on the VM, connected to the Log Analytics Workspace using Workspace ID and Primary Key
- Configured the Windows Security Events via Legacy Agent connector in Sentinel (Common event set)
- Created a Data Collection Rule in Azure Monitor to define which log channels to forward
- Verified connectivity by running Heartbeat | take 10 in Sentinel Logs — confirmed 15+ heartbeats per 15 minutes
Sysmon install command
C:\Sysmon\Sysmon64.exe -accepteula -i C:\Sysmon\sysmonconfig.xml
Verify agent running
Get-Service HealthService
# Expected output:
# Status Name DisplayName
# Running HealthService Microsoft Monitoring Agent
# Expected output:
# Status Name DisplayName
# Running HealthService Microsoft Monitoring Agent
PHASE 03
Attack Simulation — Atomic Red Team
Simulated real adversary techniques from the MITRE ATT&CK framework to generate detectable log activity.
- Installed Invoke-AtomicRedTeam v2.3.0 PowerShell module and downloaded all atomic test definitions
- Added Defender exclusions for the AtomicRedTeam folder to prevent simulation payloads from being blocked
- Executed T1110.001 — Brute Force simulation, generating a burst of failed logon attempts (EventID 4625)
- Confirmed events appeared in Microsoft Sentinel Logs within minutes of the simulation
Install Atomic Red Team
Install-Module -Name invoke-atomicredteam,powershell-yaml -scope CurrentUser -Force
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1'); Install-AtomicRedTeam -getAtomics -Force
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1'); Install-AtomicRedTeam -getAtomics -Force
Run brute force simulation
Import-Module invoke-atomicredteam
Invoke-AtomicTest T1110.001
Invoke-AtomicTest T1110.001
PHASE 04
KQL Detections
Wrote KQL queries to detect the simulated attacks and validated them against real log data.
- Confirmed SecurityEvent table was receiving data by querying EventID 4625 (failed logon) events
- Built a brute force detection query grouping failed logons by account, computer, and 5-minute time windows
- Validated the detection fired against the Atomic Red Team simulation output
- Enriched the query with MITRE ATT&CK tactic and technique metadata for incident context
Brute Force Detection — T1110.001
// Detects brute force logon attempts — MITRE T1110.001
SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == 4625
| summarize FailedAttempts = count() by Account, Computer, IpAddress, bin(TimeGenerated, 5m)
| where FailedAttempts > 3
| extend Severity = "High"
| extend MITRETactic = "Credential Access"
| extend MITRETechnique = "T1110.001 - Brute Force"
SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == 4625
| summarize FailedAttempts = count() by Account, Computer, IpAddress, bin(TimeGenerated, 5m)
| where FailedAttempts > 3
| extend Severity = "High"
| extend MITRETactic = "Credential Access"
| extend MITRETechnique = "T1110.001 - Brute Force"
Suspicious PowerShell Execution — T1059.001
// Detects suspicious PowerShell execution via Sysmon — MITRE T1059.001
Event
| where Source == "Microsoft-Windows-Sysmon"
| where EventID == 1
| where RenderedDescription has_any("powershell", "pwsh")
| where RenderedDescription has_any("-enc", "-EncodedCommand", "DownloadString", "-bypass")
| project TimeGenerated, Computer, RenderedDescription
| extend MITRETechnique = "T1059.001 - PowerShell"
Event
| where Source == "Microsoft-Windows-Sysmon"
| where EventID == 1
| where RenderedDescription has_any("powershell", "pwsh")
| where RenderedDescription has_any("-enc", "-EncodedCommand", "DownloadString", "-bypass")
| project TimeGenerated, Computer, RenderedDescription
| extend MITRETechnique = "T1059.001 - PowerShell"
// Results
Key Outcomes
End-to-end pipeline
Attack simulation → log ingestion → KQL detection → Sentinel incident, fully validated.
Real Security Events
Confirmed EventID 4625 (failed logon) events flowing from VM into Sentinel within minutes of simulation.
MITRE ATT&CK mapped
Detections enriched with tactic and technique metadata aligned to the ATT&CK framework.
Hybrid architecture
On-premises VM feeding a cloud SIEM — mirrors real MSSP customer environments.
// Stack
Tools & Technologies
Microsoft Sentinel
KQL
Azure Monitor
Windows Server 2022
VirtualBox
Sysmon v15.20
Microsoft Monitoring Agent
Atomic Red Team v2.3.0
PowerShell
Azure Cloud Shell
MITRE ATT&CK
Log Analytics Workspace