Purple Team / SIEM Lab Setup

# Clone the Wazuh Docker repository and pin a 4.x release tag.
# main tracks the next major (5.x) and no longer ships generate-indexer-certs.yml,
# which is why an unpinned clone fails at the certificate step.
git clone --branch v4.14.9 --depth 1 https://github.com/wazuh/wazuh-docker.git
cd wazuh-docker/single-node

# Generate self-signed certificates
docker compose -f generate-indexer-certs.yml run --rm generator

# Start Wazuh stack (Manager + Indexer + Dashboard)
docker compose up -d

# Access dashboard at https://localhost:443
# Default lab credentials are documented in the upstream compose files
# Change the password immediately after first login

# Check status
docker compose ps

# Download and install Wazuh agent on target Windows machines
# Run in PowerShell as Administrator

# Agent version must match the manager release. The /4.x/ path segment is
# literal for the whole 4.x series; 4.14.9 is a published build.
$WazuhAgentVersion = "4.14.9"
$WazuhAgentUrl = "https://packages.wazuh.com/4.x/windows/wazuh-agent-$WazuhAgentVersion-1.msi"
Invoke-WebRequest -Uri $WazuhAgentUrl -OutFile wazuh-agent.msi

# Confirm the download is a real MSI before installing
Get-Item .\wazuh-agent.msi | Select-Object Name, Length

# Install with manager IP
msiexec.exe /i wazuh-agent.msi /q WAZUH_MANAGER="10.10.10.50" WAZUH_REGISTRATION_SERVER="10.10.10.50"

# Start the agent service
NET START WazuhSvc

# Verify connection
& "C:\Program Files (x86)\ossec-agent\agent-auth.exe" -m 10.10.10.50

# Install Winlogbeat on a Windows target (DC or workstation), as Administrator
# Download from elastic.co/downloads/beats/winlogbeat, extract it, and run
# the commands below from that folder (winlogbeat.yml is written beside the exe).

# The default output is localhost:9200, which ships nowhere on an endpoint.
# Write a real winlogbeat.yml next to winlogbeat.exe before running setup.
@'
winlogbeat.event_logs:
  - name: Security
  - name: Microsoft-Windows-Sysmon/Operational
  - name: Microsoft-Windows-PowerShell/Operational
  - name: Windows PowerShell

output.elasticsearch:
  hosts: ["10.10.10.50:9200"]
  username: "elastic"
  password: "LAB_ONLY_change_after_boot"

setup.kibana:
  host: "10.10.10.50:5601"
'@ | Set-Content -Path .\winlogbeat.yml -Encoding UTF8

# Install and start the service, then confirm the SIEM is receiving events
.\winlogbeat.exe setup
.\install-service-winlogbeat.ps1
Start-Service winlogbeat
curl.exe -u elastic:LAB_ONLY_change_after_boot "http://10.10.10.50:9200/_cat/indices/winlogbeat-*?v"

# The `sigma` command ships in SigmaHQ/sigma-cli; pySigma itself is a library
# with no console script, so `pipx install pySigma` gives you nothing to run.
pipx install sigma-cli

# Install conversion backends as sigma-cli plugins. They land inside the pipx
# venv, so this also avoids PEP 668 "externally managed environment" errors.
sigma plugin install elasticsearch   # Elastic
sigma plugin install splunk          # Splunk
sigma plugin install opensearch      # OpenSearch-backed stores

# List the plugin-provided targets before converting
sigma list targets

# Clone the Sigma rules repository
git clone https://github.com/SigmaHQ/sigma.git ~/tools/sigma
cd ~/tools/sigma

# Browse detection rules
ls rules/windows/process_creation/
ls rules/windows/builtin/security/

title: Kerberoasting Activity Detected
id: a1234567-89ab-cdef-0123-456789abcdef
status: experimental
description: Detects potential Kerberoasting by monitoring TGS ticket requests for RC4 encryption
author: Purple Team Lab
date: 2026/01/01
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    TicketEncryptionType: '0x17'  # RC4 encryption
    TicketOptions: '0x40810000'
  filter:
    ServiceName|endswith: '$'  # Exclude machine accounts
  condition: selection and not filter
falsepositives:
  - Legacy applications using RC4
level: high
tags:
  - attack.credential_access
  - attack.t1558.003

# Backend ids come from `sigma list targets`. The Elasticsearch backend
# exposes `lucene` (with formats such as dsl_lucene or siem_rule_ndjson);
# `opensearch` is the OpenSearch backend. Both require a field-mapping
# pipeline, which is why ecs_windows is passed on every conversion.

# Convert the real Kerberoasting rule from the Sigma repository
sigma convert -t lucene -p ecs_windows rules/windows/builtin/security/win_security_kerberoasting_activity.yml

# Same rule for an OpenSearch-backed index
sigma convert -t opensearch -p ecs_windows rules/windows/builtin/security/win_security_kerberoasting_activity.yml

# Batch convert the whole security directory, one file per rule
sigma convert -t lucene -p ecs_windows --output-dir elastic-rules/ rules/windows/builtin/security/

<!-- Detect Kerberoasting (TGS with RC4) -->
<group name="windows,kerberos,">
  <rule id="100100" level="12">
    <if_sid>60103</if_sid>
    <field name="win.eventdata.ticketEncryptionType">0x17</field>
    <field name="win.eventdata.serviceName" negate="yes">\$$</field>
    <description>Potential Kerberoasting: TGS request with RC4 encryption for $(win.eventdata.serviceName)</description>
    <mitre>
      <id>T1558.003</id>
    </mitre>
  </rule>

  <!-- Detect suspicious service installation (PsExec) -->
  <rule id="100101" level="10">
    <!-- 61138 = "New Windows Service Created" (System channel event 7045).
         61603 is Sysmon Event 1 and never carries a serviceName, so this
         rule would have matched nothing. -->
    <if_sid>61138</if_sid>
    <field name="win.eventdata.serviceName">PSEXESVC</field>
    <description>PsExec service detected: possible lateral movement</description>
    <mitre>
      <id>T1021.002</id>
    </mitre>
  </rule>

  <!-- Detect Mimikatz-style process names -->
  <rule id="100102" level="14">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image" type="pcre2">(?i)mimikatz|sekurlsa|kiwi</field>
    <description>Potential credential dumping tool detected: $(win.eventdata.image)</description>
    <mitre>
      <id>T1003.001</id>
    </mitre>
  </rule>
</group>

# List lab indices
curl -u elastic:LAB_ONLY_change_after_boot http://localhost:9200/_cat/indices?v

# Delete disposable lab indices after exporting evidence
curl -u elastic:LAB_ONLY_change_after_boot -X DELETE "http://localhost:9200/winlogbeat-*"
curl -u elastic:LAB_ONLY_change_after_boot -X DELETE "http://localhost:9200/logstash-*"

# Full disposable stack cleanup
docker compose down -v

# Confirm Windows event ingestion
event.code:4624 or event.code:4688

# Kerberoasting signal check
event.code:4769 and winlog.event_data.TicketEncryptionType:0x17

# PowerShell script block signal check
event.code:4104 and powershell.file.script_block_text:*