<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-attack-simulation-lab
description: >-
  Design, deploy, and manage isolated attack simulation labs for safe purple
  team testing. Covers network segmentation, vulnerable target deployment,
  SIEM/EDR instrumentation, and automated lab provisioning with Terraform.
domain: cybersecurity
subdomain: purple-team
tags:
  - lab-environment
  - attack-simulation
  - terraform
  - vagrant
  - detection-lab
  - siem
  - network-segmentation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Building Attack Simulation Lab

## Overview

A dedicated attack simulation lab provides an isolated environment for safely
executing adversary techniques, validating detections, and training analysts.
The lab mirrors production monitoring (SIEM, EDR, Sysmon) while containing
all attack traffic within a segmented network.

## Prerequisites

| Requirement | Install |
|---|---|
| Terraform | `brew install terraform` or binary download |
| Vagrant | `brew install vagrant` with VirtualBox/libvirt provider |
| Docker/Compose | Container-based SIEM and tooling |
| Python 3.10+ | Agent tooling and automation |
| 32GB+ RAM | Recommended for full lab stack |

## Key Concepts

### Lab Architecture

```
┌─────────────────────────────────────────┐
│ Management VLAN (10.0.0.0/24)           │
│  ┌──────────┐  ┌──────────┐            │
│  │ CALDERA   │  │ ATT&CK   │            │
│  │ C2 Server │  │ Navigator│            │
│  └──────────┘  └──────────┘            │
├─────────────────────────────────────────┤
│ Target VLAN (10.0.1.0/24)              │
│  ┌──────────┐  ┌──────────┐  ┌───────┐│
│  │ Windows   │  │ Linux    │  │ AD DC ││
│  │ Workstation│  │ Server   │  │       ││
│  └──────────┘  └──────────┘  └───────┘│
├─────────────────────────────────────────┤
│ Monitoring VLAN (10.0.2.0/24)          │
│  ┌──────────┐  ┌──────────┐  ┌───────┐│
│  │ Splunk/   │  │ Wazuh    │  │Zeek/  ││
│  │ Elastic   │  │ EDR      │  │Suricata│
│  └──────────┘  └──────────┘  └───────┘│
└─────────────────────────────────────────┘
```

### Component Stack

| Component | Purpose | Deployment |
|---|---|---|
| Splunk/Elastic | SIEM for log aggregation and detection | Docker |
| Wazuh | Host-based EDR and FIM | Agent on targets |
| Sysmon | Detailed Windows telemetry | MSI on Windows targets |
| Zeek | Network traffic analysis | Docker or native |
| Suricata | Network IDS/IPS | Docker or native |
| CALDERA | Attack emulation C2 | Docker or native |
| Active Directory | Domain environment target | Vagrant/Terraform |

## Workflow

### 1. Provision Infrastructure

```bash
# Deploy lab with Terraform
node scripts/agent.js provision \
  --template full-lab \
  --output lab-config.json

# Using Docker Compose for SIEM stack
docker compose -f docker-compose-siem.yml up -d

# Vagrant for Windows targets
cd vagrant/windows && vagrant up
```

### 2. Configure Monitoring

```bash
# Deploy Sysmon on Windows targets
sysmon64.exe -accepteula -i sysmonconfig-export.xml

# Configure Wazuh agent
/var/ossec/bin/agent-auth -m 10.0.2.10
systemctl restart wazuh-agent

# Deploy Zeek
docker run -d --net=host --name zeek zeek/zeek -i eth0
```

### 3. Validate Lab Health

```bash
# Check all components are running
node scripts/agent.js health-check --config lab-config.json

# Verify log flow
node scripts/agent.js verify-logs \
  --siem-url http://localhost:9200 \
  --expected-sources sysmon,wazuh,zeek,suricata
```

### 4. Teardown

```bash
# Destroy lab environment
node scripts/agent.js teardown --config lab-config.json

# Or manual cleanup
docker compose down -v
cd vagrant/windows && vagrant destroy -f
```

## Verification

| Check | Method |
|---|---|
| Network isolation | No routing between lab VLAN and production |
| SIEM receiving logs | Query shows events from all target hosts |
| Sysmon active | EID 1 (ProcessCreate) events flowing |
| EDR connected | Wazuh agents reporting to manager |
| NDR capturing | Zeek/Suricata producing conn.log and alerts |
| CALDERA accessible | HTTP 200 on management port 8888 |

## References

- [DetectionLab](https://github.com/clong/DetectionLab)
- [DVWA](https://github.com/digininja/DVWA)
- [Sysmon Config](https://github.com/SwiftOnSecurity/sysmon-config)
