How munazajamil/powershell-attack-detection-siem-wazuh works
This repository documents a SOC lab rather than implementing its runtime: PowerShell attack simulations generate Windows endpoint telemetry, which the Wazuh agent forwards for detection and dashboard review. The analyst then triages detections and records MITRE ATT&CK mappings and findings. The graph reflects relationships described in the README; no source implementation is present to verify further wiring.
Main entry points: README.md Windows Endpoint · MITRE-mapping.md ATT&CK Mapping · writeup.md Evidence Writeup
Components 10
Attack Simulation
- PowerShell Attacks
README.md
Endpoint Detection
- Windows Endpoint
README.md - Defender AMSI
README.md - Wazuh Agent
README.md - Wazuh SIEM
README.md
SOC Analysis
- Wazuh Dashboard
README.md - ATT&CK Mapping
MITRE-mapping.md - Evidence Writeup
screenshots/writeup.md
Other components
- Attack Operator
- SOC Analyst
Connections 10
- Attack Operator → PowerShell Attacks: runs
- PowerShell Attacks → Windows Endpoint: executes on
- Windows Endpoint → Defender AMSI: scans scripts
- Defender AMSI → Windows Endpoint: blocks payload
- Windows Endpoint → Wazuh Agent: generates telemetry
- Wazuh Agent → Wazuh SIEM: forwards events
- Wazuh SIEM → Wazuh Dashboard: presents alerts
- SOC Analyst → Wazuh Dashboard: triages alerts
- SOC Analyst → ATT&CK Mapping: records mappings
- SOC Analyst → Evidence Writeup: documents findings