Project Zero: Enterprise Lab (Part 1)

-Hypervisor: VirtualBox using a dedicated NAT network (10.0.0.0/24).

-Goal: Simulate a basic corporate network, attack it end‑to‑end, and use the lab as a baseline for future detections and hardening.

-Provisioned all VMs and set up the internal NAT network.

-Deployed AD and DNS, then joined key machines to the domain with real user accounts.

-Set up MailHog for safe phishing and credential‑harvesting tests.

-Installed Wazuh and integrated logs from hosts into a single SIEM.

-Ran a full cyberattack (phishing → foothold → lateral movement → privilege escalation) and traced it in Wazuh telemetry, then used the findings to identify coverage gaps.

-VirtualBox

-Windows Server 2025 & Windows 11

-Ubuntu Server & Ubuntu Desktop 22.04

-Active Directory

-MailHog Server

-Wazuh

-Kali Linux

-docs/01-enterprise-network.md – Built a realistic enterprise lab network on 10.0.0.0/24 with a Windows domain controller, Windows and Ubuntu workstations, mail and security servers (MailHog, Wazuh SIEM), and a Kali attacker VM, all provisioned as virtual machines and joined to the same environment.

-docs/02-vulnerable-environment-&-detections.md – Intentionally weakened the lab to mirror real‑world misconfigurations: enabled password‑based SSH and root logins on Linux servers and clients, exposed WinRM and RDP on Windows hosts, and stood up a fake “production” secrets file, then integrated Wazuh to detect this activity by building custom rules, file integrity monitoring, and alerting for failed SSH, WinRM logons, RDP logons, and access to the sensitive file, with gaps left on select hosts to demonstrate missing coverage .

-docs/03-attack-simulation.md – Ran a full kill‑chain against the lab: brute‑forced SSH, phished user creds via a fake password reset site, moved laterally with WinRM/Evil‑WinRM into the domain controller, exfiltrated a sensitive secrets file, and planted a persistent backdoor via a scheduled PowerShell reverse shell .