Hands-on detection lab

Portfolio updated weekly

Windows Detection Engineering Lab

Test Windows detection rules from event log to final report.

I built this lab to practice the full detection workflow. It reads Windows Security and Sysmon-style events, checks them against six rules, maps each finding to MITRE ATT&CK, and shows what an analyst should investigate next.

Open the lab Read case study

Runs in your browser

Imported JSON is checked and analyzed locally. The file is not uploaded.

Six focused rules

Each rule uses specific event fields or thresholds that can be reviewed in the lab.

Built-in test cases

Five harmless scenarios check that every rule produces the expected result.

Quick start

Walk through one finding from start to finish.

This walkthrough loads a harmless encoded PowerShell event, runs the related rules, and opens the evidence behind the result.

Load events

Demonstration events

Apply rules

6 of 6 enabled

Review findings

6 findings

Report

Ready to export

Six sample findings are loaded and ready to review.

Events

Hosts

Findings

High priority

ATT&CK techniques

1. Event data

Current dataset: Demonstration events. Imported JSON stays in this browser session.

Sample

2. Detection rules

6 of 6 rules enabled. Open this section to review or change them.

DET-001highEncoded PowerShell commandT1059.001 · Sysmon Event ID 1DET-002criticalOffice application launched a script engineT1204.002 · Sysmon Event ID 1DET-003mediumScheduled task creationT1053.005 · Security Event ID 4698 or Sysmon Event ID 1DET-004mediumRepeated failed logonsT1110 · Security Event ID 4625DET-005mediumUnusual DNS queryT1071.004 · Sysmon Event ID 22DET-006highAccount added to local AdministratorsT1098 · Security Event ID 4732

3. Findings

6 of 6 shown. Choose one to review the evidence.

DET-002critical

Office application launched a script engine

MITRE ATT&CK T1204.002 · Execution

WIN11-LAB-01

Jul 15, 1:10 PM UTC

What matched

winword.exe launched powershell.exe on WIN11-LAB-01.

Source event: test-ps-001

Matching evidence

Parent image: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Child image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Command: powershell.exe -NoProfile -EncodedCommand SAFE-LAB-TEST

What I would check next

1Identify the document, message, or attachment that started the process.
2Review the full child-process command line and file hashes.
3Isolate the host if the activity is not expected.

How the activity connects

This view changes with the selected finding. It only shows the accounts, processes, hosts, network activity, and resources tied to that evidence.

Connections in this finding

WIN11-LAB-01 recorded process powershell.exe
LAB\analyst executed as powershell.exe
WINWORD.EXE launched powershell.exe

Rule tests

0 of 5 tests passed in this session. These controls add sample log records; they do not run commands.

Encoded PowerShell

Expected result: DET-001 + DET-002

Adds one harmless PowerShell process event. Both related rules should match it.

Scheduled task

Expected result: DET-003

Adds a scheduled-task record. DET-003 should identify the new task.

Failed logons

Expected result: DET-004

Adds five failed logons for one account within ten minutes. DET-004 should match the pattern.

Unusual DNS query

Expected result: DET-005

Adds one unusually long test-domain query. DET-005 should flag the query.

Local admin change

Expected result: DET-006

Adds one account to the local Administrators group. DET-006 should catch the change.

4. Event timeline

Showing 14 events, newest first. Amber rows are part of the selected finding.

Local Group Membership Changed

Security 4732 · WIN11-LAB-02

Time: Jul 15, 1:22 PM UTC
User: lab-temp-admin
Value: Member lab-temp-admin added to local group Administrators

DNS Query

Sysmon 22 · WIN11-LAB-01

Time: Jul 15, 1:20 PM UTC
User: LAB\analyst
Value: encoded-lab-telemetry-channel-0001.security-validation.example

Failed Logon

Security 4625 · WIN11-LAB-02

Time: Jul 15, 1:18 PM UTC
User: svc-backup
Value: Network logon type 3 - bad password

Failed Logon

Security 4625 · WIN11-LAB-02

Time: Jul 15, 1:17 PM UTC
User: svc-backup
Value: Network logon type 3 - bad password

Failed Logon

Security 4625 · WIN11-LAB-02

Time: Jul 15, 1:16 PM UTC
User: svc-backup
Value: Network logon type 3 - bad password

Failed Logon

Security 4625 · WIN11-LAB-02

Time: Jul 15, 1:15 PM UTC
User: svc-backup
Value: Network logon type 3 - bad password

Failed Logon

Security 4625 · WIN11-LAB-02

Time: Jul 15, 1:14 PM UTC
User: svc-backup
Value: Network logon type 3 - bad password

Scheduled Task Created

Security 4698 · WIN11-LAB-02

Time: Jul 15, 1:12 PM UTC
User: LAB\helpdesk
Value: schtasks.exe /Create /TN LabHealthCheck /TR C:\Lab\health-check.cmd

Process Create

Sysmon 1 · WIN11-LAB-01

Evidence

Time: Jul 15, 1:10 PM UTC
User: LAB\analyst
Value: powershell.exe -NoProfile -EncodedCommand SAFE-LAB-TEST

Process Create

Sysmon 1 · WIN11-LAB-02

Time: Jul 15, 1:04 PM UTC
User: LAB\helpdesk
Value: powershell.exe Get-Service

Successful Logon

Security 4624 · WIN11-LAB-01

Time: Jul 15, 1:03 PM UTC
User: LAB\analyst
Value: Interactive logon type 2

DNS Query

Sysmon 22 · WIN11-LAB-01

Time: Jul 15, 1:02 PM UTC
User: LAB\analyst
Value: learn.microsoft.com

Process Create

Sysmon 1 · WIN11-LAB-01

Time: Jul 15, 1:01 PM UTC
User: LAB\analyst
Value: WINWORD.EXE C:\Lab\quarterly-review.docx

Process Create

Sysmon 1 · WIN11-LAB-01

Time: Jul 15, 1:00 PM UTC
User: LAB\analyst
Value: C:\Windows\explorer.exe

Time	Host	Channel / ID	Event	User	Observed value
Jul 15, 1:22 PM UTC	WIN11-LAB-02	Security 4732	Local Group Membership Changed	lab-temp-admin	Member lab-temp-admin added to local group Administrators
Jul 15, 1:20 PM UTC	WIN11-LAB-01	Sysmon 22	DNS Query	LAB\analyst	encoded-lab-telemetry-channel-0001.security-validation.example
Jul 15, 1:18 PM UTC	WIN11-LAB-02	Security 4625	Failed Logon	svc-backup	Network logon type 3 - bad password
Jul 15, 1:17 PM UTC	WIN11-LAB-02	Security 4625	Failed Logon	svc-backup	Network logon type 3 - bad password
Jul 15, 1:16 PM UTC	WIN11-LAB-02	Security 4625	Failed Logon	svc-backup	Network logon type 3 - bad password
Jul 15, 1:15 PM UTC	WIN11-LAB-02	Security 4625	Failed Logon	svc-backup	Network logon type 3 - bad password
Jul 15, 1:14 PM UTC	WIN11-LAB-02	Security 4625	Failed Logon	svc-backup	Network logon type 3 - bad password
Jul 15, 1:12 PM UTC	WIN11-LAB-02	Security 4698	Scheduled Task Created	LAB\helpdesk	schtasks.exe /Create /TN LabHealthCheck /TR C:\Lab\health-check.cmd
Jul 15, 1:10 PM UTC	WIN11-LAB-01	Sysmon 1	Process Create	LAB\analyst	powershell.exe -NoProfile -EncodedCommand SAFE-LAB-TEST
Jul 15, 1:04 PM UTC	WIN11-LAB-02	Sysmon 1	Process Create	LAB\helpdesk	powershell.exe Get-Service
Jul 15, 1:03 PM UTC	WIN11-LAB-01	Security 4624	Successful Logon	LAB\analyst	Interactive logon type 2
Jul 15, 1:02 PM UTC	WIN11-LAB-01	Sysmon 22	DNS Query	LAB\analyst	learn.microsoft.com
Jul 15, 1:01 PM UTC	WIN11-LAB-01	Sysmon 1	Process Create	LAB\analyst	WINWORD.EXE C:\Lab\quarterly-review.docx
Jul 15, 1:00 PM UTC	WIN11-LAB-01	Sysmon 1	Process Create	LAB\analyst	C:\Windows\explorer.exe

How it works

The event data decides what matches.

Each finding points back to the rule and events that created it. I also include the ATT&CK mapping, the matching fields, and the next questions I would ask during triage. No finding is generated from free-form AI output.

Scope

Built for practice, not production monitoring.

All included records are fictional. The lab demonstrates my approach to detection engineering, but it is not an endpoint agent, SIEM, incident-response service, or replacement for an authorized security assessment.

Technical references

Microsoft Sysmon Sigma specification MITRE ATT&CK Atomic Red Team