# munazajamil/powershell-attack-detection-siem-wazuh architecture

> Architecture diagram of the GitHub repository munazajamil/powershell-attack-detection-siem-wazuh, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/munazajamil/powershell-attack-detection-siem-wazuh
- Repository: https://github.com/munazajamil/powershell-attack-detection-siem-wazuh

## Overview

This repository documents a SOC lab rather than implementing its runtime: PowerShell attack simulations generate Windows endpoint telemetry, which the Wazuh agent forwards for detection and dashboard review. The analyst then triages detections and records MITRE ATT&CK mappings and findings. The graph reflects relationships described in the README; no source implementation is present to verify further wiring.

Main entry points: [`README.md`](https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/README.md) (Windows Endpoint), [`MITRE-mapping.md`](https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/MITRE-mapping.md) (ATT&CK Mapping), [`screenshots/writeup.md`](https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/screenshots/writeup.md) (Evidence Writeup)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_simulation["Attack Simulation"]
  node_simulations["PowerShell Attacks<br/>[README.md]"]
end

subgraph group_detection["Endpoint Detection"]
  node_endpoint["Windows Endpoint<br/>[README.md]"]
  node_defender["Defender AMSI<br/>[README.md]"]
  node_agent["Wazuh Agent<br/>[README.md]"]
  node_wazuh["Wazuh SIEM<br/>[README.md]"]
end

subgraph group_analysis["SOC Analysis"]
  node_dashboard["Wazuh Dashboard<br/>[README.md]"]
  node_mitre["ATT&amp;CK Mapping<br/>[MITRE-mapping.md]"]
  node_writeup["Evidence Writeup<br/>[writeup.md]"]
end

node_attacker(("Attack Operator"))
node_analyst(("SOC Analyst"))

node_attacker -->|"runs"| node_simulations
node_simulations -->|"executes on"| node_endpoint
node_endpoint -->|"scans scripts"| node_defender
node_defender -->|"blocks payload"| node_endpoint
node_endpoint -->|"generates telemetry"| node_agent
node_agent -->|"forwards events"| node_wazuh
node_wazuh -->|"presents alerts"| node_dashboard
node_analyst -->|"triages alerts"| node_dashboard
node_analyst -->|"records mappings"| node_mitre
node_analyst -->|"documents findings"| node_writeup

click node_simulations "https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/README.md"
click node_endpoint "https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/README.md"
click node_defender "https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/README.md"
click node_agent "https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/README.md"
click node_wazuh "https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/README.md"
click node_dashboard "https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/README.md"
click node_mitre "https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/MITRE-mapping.md"
click node_writeup "https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/screenshots/writeup.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_simulations toneBlue
class node_endpoint,node_defender,node_agent,node_wazuh toneAmber
class node_dashboard,node_mitre,node_writeup toneMint
class node_attacker,node_analyst toneIndigo
```

## Components

### Attack Simulation

- [PowerShell Attacks](https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/README.md): `README.md`

### Endpoint Detection

- [Windows Endpoint](https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/README.md): `README.md`
- [Defender AMSI](https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/README.md): `README.md`
- [Wazuh Agent](https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/README.md): `README.md`
- [Wazuh SIEM](https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/README.md): `README.md`

### SOC Analysis

- [Wazuh Dashboard](https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/README.md): `README.md`
- [ATT&CK Mapping](https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/MITRE-mapping.md): `MITRE-mapping.md`
- [Evidence Writeup](https://github.com/munazajamil/powershell-attack-detection-siem-wazuh/blob/main/screenshots/writeup.md): `screenshots/writeup.md`

### Other components

- **Attack Operator**
- **SOC Analyst**

## Connections

- Attack Operator → PowerShell Attacks: runs
- PowerShell Attacks → Windows Endpoint: executes on
- Windows Endpoint → Defender AMSI: scans scripts
- Defender AMSI → Windows Endpoint: blocks payload
- Windows Endpoint → Wazuh Agent: generates telemetry
- Wazuh Agent → Wazuh SIEM: forwards events
- Wazuh SIEM → Wazuh Dashboard: presents alerts
- SOC Analyst → Wazuh Dashboard: triages alerts
- SOC Analyst → ATT&CK Mapping: records mappings
- SOC Analyst → Evidence Writeup: documents findings