Building an enterprise-grade SOC lab from scratch — Active Directory, Elastic SIEM, Suricata IDS, TheHive SOAR, and AI-assisted threat detection. Pursuing SOC L1.
I am a cybersecurity student at Parul University with 4 years of security study, now seriously pursuing a career in Security Operations for the last 6 weeks.
I built a fully functional enterprise SOC home lab from scratch — dual domain controllers, multi-subnet AD environment, hybrid cloud connectivity via Tailscale, and a full detection stack using Elastic SIEM, Suricata IDS, Zeek, TheHive SOAR, and Sysmon.
I operate both the red and blue sides of my lab — I run attack simulations using Atomic Red Team and Kali Linux, then investigate and document every detection as a formal incident report. I understand attacks from both the attacker's and defender's perspective.
Currently preparing for the HTB CDSA exam and CompTIA Security+. Targeting a SOC Analyst L1 role.
A real enterprise simulation — multi-subnet AD environment connected to hybrid Azure cloud, with full-stack detection from host to network layer.
One main project — an enterprise SOC environment built and operated entirely by me, from network design to threat detection to incident response.
| MITRE ID | Technique | Tool Used | Detection |
|---|---|---|---|
| T1003.001 | LSASS Credential Dump | Mimikatz | Elastic Event ID 10 rule |
| T1110.001 | Password Spray | CrackMapExec | Brute force rule — TheHive case |
| T1021.002 | Lateral Movement SMB | PsExec | Event ID 7045 + network log |
| T1557.001 | LLMNR Poisoning | Responder | Zeek DNS + Suricata alert |
| T1059.001 | PowerShell Encoded Cmd | Atomic Red Team | Encoded command KQL rule |
| T1053.005 | Scheduled Task Persistence | Atomic Red Team | Event ID 4698 detection |
Skills and tools I am actively studying or planning to implement next in my lab.