> For the complete documentation index, see [llms.txt](https://blog.r00t-hunter.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.r00t-hunter.com/ad-lab-built-with-purpose/soc-and-detection-engineering.md).
# SOC and Detection Engineering
#### Stack Components and Realistic Expectations
Security Onion 2.4 in standalone eval mode on a 4 GB VM. Below the documented minimum of 12 GB for eval mode. It runs. It does not run reliably at enterprise scale.
**What this stack is good for in this lab:**
* Conceptual detection validation: does the rule logic fire for this event class?
* Telemetry correlation study: what does Zeek `kerberos.log` look like alongside EventID 4769?
* Detection engineering iteration: tuning thresholds against known traffic
**What this stack is not good for:**
* Accurate alert timing benchmarks
* High-confidence packet capture completeness under sustained load
* Correlation latency measurements that mean anything at production scale
#### A Note on Windows Defender
Defender is partially configured on workstations real-time protection is reduced but behavioral detections and ScriptBlock logging remain active. A fully disabled Defender changes the telemetry significantly: process lineage looks different, AMSI inspection is absent, and several Sysmon events that would normally fire alongside Defender detections go missing. If Defender evasion is what you want to study, leave Defender more fully enabled and study evasion against actual behavioral detections.
#### Stack Components
| Component | Function | Key Log Sources |
| -------------- | ------------------------------------------------------- | ------------------------------------------------------------------- |
| Zeek | Network behavioral metadata from raw PCAP | conn.log, dns.log, kerberos.log, smb\_files.log, ntlm.log, ldap.log |
| Suricata | Signature-based IDS ET Open + custom rules | Alert stream → Elasticsearch |
| Wazuh (HIDS) | Host agent on all Windows VMs; Sysmon integration | wazuh-alerts-\* index |
| Sysmon | Kernel-level process, network, registry, file telemetry | EID 1, 3, 7, 8, 10, 11, 13, 22 |
| TheHive + MISP | Case management for IR exercises | Cases, alerts, IOC pipeline |
#### Critical Windows Event IDs
| Event ID | Log | Captures | Attack Phase |
| ----------- | -------- | ----------------------------------------------------- | ------------------------------------- |
| 4624 | Security | Successful logon (type, auth pkg, source IP) | Lateral movement, unexpected DA logon |
| 4662 | Security | AD object operation includes GUID | DCSync when from non-DC source |
| 4769 | Security | Kerberos TGS request EncType, service name, client IP | Kerberoasting: RC4 spike (0x17) |
| 4776 | Security | NTLM credential validation on DC | PtH, NTLM relay |
| 10 (Sysmon) | Sysmon | Process access source, target, access rights mask | LSASS access with 0x1010 / 0x1FFFFF |
| 4698 | Security | Scheduled task created | Persistence via scheduled task |
| 5136 | Security | DS object modified old/new values | AdminSDHolder ACL write, DACL abuse |
| 4742 | Security | Computer account changed | RBCD setup |
| 4771 | Security | Kerberos pre-auth failed | AS-REP roasting |
| 7 (Sysmon) | Sysmon | Image loaded DLL path, signer, hash | Unsigned DLL sideload |
| | | | |
#### Detection Rules
***
**DETECT-001 DCSync from Non-DC Source**
EventID 4662 where Properties contains GUID `1131f6ad-9c07-11d1-f79f-00c04fc2dcd2` AND SubjectUserSid is not a DC machine account. A user account performing DCSync is malicious. High-confidence with a maintained DC allowlist though allowlist accuracy requires ongoing attention as DC inventory changes.
***
**DETECT-002 Kerberoasting TGS Spike**
Alert when a single source IP generates more than 3 EventID 4769 records within 60 seconds where TicketEncryptionType = 0x17 (RC4-HMAC). Modern Kerberos prefers AES (0x12 / 0x11). RC4 requests outside known legacy application paths indicate offline cracking preparation.
Tuning note: if your environment has legacy application servers that legitimately use RC4, establish a per-source baseline before applying this threshold. Three requests in 60 seconds is a starting point for this lab, not a universal recommendation.
***
**DETECT-003 LSASS Memory Access by Non-System Process**
Sysmon EventID 10 where TargetImage ends in `lsass.exe` AND SourceImage is not in an allowlist of known accessing processes. Access rights filter: 0x1010, 0x1FFFFF, or 0x1038. Allowlist maintenance is critical legitimate security tooling, backup agents, and some AV products access LSASS regularly.
***
**DETECT-004 Pass-the-Hash Behavioral Correlation**
Zeek `ntlm.log` combined with EventID 4624 LogonType=3 (network logon) with NTLM where:
* Source IP is in the workstation subnet
* Destination is a system the source has no documented access requirement for
* Logon succeeds
* No prior EventID 4624 LogonType=2 (interactive logon) for the account on that source workstation in the preceding window
The lookback window for interactive logon history requires tuning too short and you miss roaming accounts; too long and correlation becomes noisy.
***
**DETECT-005 BloodHound / SharpHound LDAP Enumeration**
More than 200 LDAP queries from a single source IP to a DC within 120 seconds. SharpHound's default collection issues hundreds of LDAP requests rapidly. Legitimate workstation LDAP usage is low-frequency by comparison. Secondary signal: EventID 1644 (Expensive LDAP Query) in the DC's Directory Services log.
***
**DETECT-006 AdminSDHolder ACL Modification**
EventID 5136 where ObjectDN = `CN=AdminSDHolder,CN=System,DC=usa,DC=corp,DC=local` and AttributeLDAPDisplayName = `nTSecurityDescriptor`. Any modification outside a documented and approved change window warrants immediate investigation. The 60-minute SDProp propagation window is the incident response window.
***
#### IR Escalation Tiers
| Tier | Trigger Conditions | Response |
| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
| P1 Critical | DCSync from non-DC; Golden ticket usage (anomalous PAC/long validity); AdminSDHolder write; Confirmed active external C2; Mass file rename across shares | Immediate isolate hosts, snapshot memory, begin krbtgt double-rotation |
| P2 High | LSASS access from non-AV process; Kerberoasting TGS spike; BloodHound LDAP sweep; WMI lateral movement signal; Unexpected DA logon to non-DC | 15 min contain source, memory acquisition, Zeek session correlation, begin timeline |
| P3 Medium | Failed logon spike >10 in 5 min from single source; Encoded PowerShell execution; Scheduled task by non-admin; Cross-domain auth from previously unseen account pair | 1 hr investigate, correlate recent changes, determine active vs residual |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://blog.r00t-hunter.com/ad-lab-built-with-purpose/soc-and-detection-engineering.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.