Status: Complete

Scope:

Built a Security Operations Center lab in Microsoft Azure to gain hands-on experience with the detection and analysis workflow of a real SOC environment. The lab centered on a Windows 10 virtual machine deliberately exposed to the internet to serve as a honeypot for genuine, unsolicited attack traffic rather than simulated data.

Process:

Deployed the lab under a dedicated resource group (MV_SOC_Lab) in Azure’s West US 2 region, including a virtual network and a Windows 10 VM (CORP-INET-WEST). Opened the machine’s Network Security Group to allow all inbound traffic and disabled both Windows Defender and the Windows Firewall, removing default protections so the VM was genuinely reachable to real attackers rather than isolated in a controlled simulation.

Connected the VM to a Log Analytics Workspace (LAW-SOC-Lab) and provisioned a Microsoft Sentinel instance as the lab’s SIEM. After leaving the honeypot exposed, queried the accumulated security events using KQL, first to confirm real attack traffic was present:

SecurityEvent
| where EventID == 4625
| project TimeGenerated, Account, Computer, EventID, Activity, IpAddress

Then aggregated the data to identify the most persistent attackers:

SecurityEvent
| where EventID == 4625
| summarize count() by IpAddress
| order by count_ desc

Within 24 hours, the top attacking IP (103.212.145.193) generated over 2,000 failed login attempts on its own, with several other IPs each contributing 500–1,000+ attempts — consistent with automated brute-force scanning rather than isolated or targeted human attacks. Observed accounts being targeted included predictable usernames like “administrator” and “test,” typical of credential-stuffing tools scanning broadly rather than probing for anything specific.

Also explored Microsoft Sentinel’s built-in MITRE ATT&CK workbook to map observed activity against named adversary techniques, including reviewing detections categorized under Modify Authentication Process (T1556).

Decisions & Scope:

Chose not to build the attack-map visualization from the original tutorial, since it relies on importing pre-built JSON that wasn’t written independently and couldn’t be fully explained in technical detail. Prioritized time on skills that could be directly demonstrated and defended instead.

Outcome:

A working end-to-end detection pipeline — an exposed honeypot generating real attack telemetry, centralized log collection, SIEM correlation, and hands-on KQL querying and aggregation against live security event data. Confirmed real-world brute-force attack patterns within 24 hours of deployment, including one IP responsible for over 2,000 login attempts on its own, and gained direct exposure to MITRE ATT&CK technique mapping through Sentinel’s analytics tools.