How to build a home cybersecurity Lab

Introduction

Learning cybersecurity concepts is important, but working through them in a realistic environment is what helped me understand how security incidents actually unfold. To build practical experience with security monitoring and incident triage, I created a Wazuh home lab where I could generate attack activity, review the resulting alerts, and investigate each event from a defender's perspective. Wazuh is an open-source security platform used to collect and analyze logs, monitor endpoints, detect suspicious activity, and support incident investigations.

Throughout the lab:

• Simulated network reconnaissance, SSH brute-force attempts, file changes, privilege escalation, and account creation
• Reviewed Wazuh alerts, authentication logs, IDS detections, audit logs, and system activity
• Practiced connecting related events across multiple log sources
• Built experience with triage, investigation, and remediation steps

Security analysts rarely make decisions from a single alert. They must review different log sources, understand the surrounding activity, and determine whether separate events are connected.

Lab Environment

The environment used three separate machines to keep the attack, monitoring, and management functions isolated. A Kali Linux system generated the activity, an Ubuntu endpoint ran the Wazuh agent, and a dedicated machine hosted the Wazuh Manager. Suricata monitored network traffic, while Wazuh gathered authentication logs, audit events, and File Integrity Monitoring data from the Ubuntu endpoint.

Architecture:

• Attacker machine: Kali Linux
• Monitored endpoint: Ubuntu with the Wazuh agent
• SIEM server: Dedicated Wazuh Manager
• Network detection: Suricata
• Collected data: Authentication logs, audit events, system logs, and file change alerts

Network Reconnaissance with Nmap and Suricata

The investigation began with an Nmap scan to simulate the reconnaissance stage of an attack. Suricata detected the ICMP activity and sent 18 alerts to Wazuh. The source and destination IP addresses were reviewed to confirm that the detections matched the scan.

• Generated reconnaissance traffic using Nmap
• Detected 18 Suricata alerts in Wazuh
• Reviewed source and destination IP addresses
• Confirmed that the alerts matched the scan activity
• Observed how attackers may search for exposed services and possible entry points

Reconnaissance is often one of the first steps in an attack. Detecting it early can help defenders identify suspicious activity before an attacker attempts to access the system.

In a real security environment, the next steps would include verifying whether the scan was authorized, blocking the source if malicious, reviewing exposed services, and monitoring for follow-up access attempts.

File Integrity Monitoring

Files were created, modified, and deleted on the Ubuntu endpoint to test Wazuh File Integrity Monitoring. The resulting alerts showed which files were affected and what type of change occurred.

• Generated file creation, modification, and deletion events
• Reviewed affected file paths and change types
• Determined whether the changes were expected or unauthorized
• Considered whether the changes could indicate tampering, persistence, or malware activity

Unauthorized file changes may show that an attacker modified system files, installed malicious content, or created a way to maintain access. Comparing the changes with authentication and privilege activity helps determine whether they are part of the same incident.

Response actions include isolating the endpoint, confirming whether the change was authorized, restoring the affected file from a trusted version, scanning for malware, and reviewing related authentication and privilege activity. The next step would be to determine whether the file change was isolated or part of broader suspicious activity.

SSH Brute-Force Detection with Hydra

After the reconnaissance scan, Hydra was used from the Kali Linux machine to generate repeated SSH login attempts against the Ubuntu endpoint. Wazuh captured 2,345 failed authentication events, making it possible to identify the brute-force pattern and investigate the targeted account.

• Generated repeated SSH login attempts with Hydra
• Captured 2,345 failed authentication events
• Reviewed the source IP, targeted account, and affected endpoint
• Compared alert timing and frequency
• Checked for successful logins or activity following the attack
• Confirmed the pattern was consistent with an SSH brute-force attempt

A large number of failed login attempts can indicate that someone is trying to guess an account password. Reviewing the pattern helps analysts determine whether the activity is a user error, an automated attack, or part of a larger compromise.

Triage would begin by reviewing the alert severity, source IP, targeted account, and timing of the attempts. If the activity were confirmed as malicious, response actions could include blocking the source IP, resetting or disabling the account, ending active sessions, and enforcing multi-factor authentication or account lockout policies.

Privilege Escalation and User Account Creation

Administrative privileges were used on the Ubuntu endpoint, followed by the creation of a new local user account. Wazuh captured the related events and showed which user was involved, what actions were taken, and how the activity unfolded.

• Generated elevated privilege activity
• Created a new local user account
• Reviewed the user, action, timestamp, and event sequence
• Looked for signs of unauthorized access or persistence
• Connected the events with earlier authentication and system activity

Attackers often try to gain higher privileges and create additional accounts after entering a system. These actions can give them more control and allow them to maintain access even if the original account is disabled.

Remediation steps would include disabling unauthorized accounts, revoking elevated privileges, resetting credentials, reviewing executed commands, and isolating the endpoint if compromise were suspected.

Lessons from the Lab

This project gave me hands-on experience working in a SIEM environment and helped me become more comfortable reviewing alerts, analyzing logs, and tracing activity across a system. By simulating several stages of an attack, I was able to see how each threat appeared in Wazuh and how separate events could connect during an investigation.

• Practiced reviewing and validating security alerts
• Analyzed network, authentication, audit, and system logs
• Worked through triage, containment, and remediation decisions
• Gained experience seeing common threats in action

The exercise showed how analysts move beyond individual alerts to build a complete picture of an incident. It strengthened my ability to follow the evidence, assess the risk, and determine the appropriate response based on the findings.

Evolve Security Academy is a Chicago-based Cybersecurity training company established in 2016. Our parent company, Evolve Security, is one of the top cybersecurity services companies in the U.S. We are cybersecurity experts who ONLY TEACH cybersecurity.

Evolve Academy helps students successfully transition into cybersecurity careers through immersive, hands-on training and dedicated career support. We ensure graduates are not only job-ready but equipped to launch lasting careers in cybersecurity.

Evolve Security Academy's 20-week part-time Cybersecurity Bootcamp offers live-online hands-on curriculum.

The 12-week CyberCore bootcamp is self-spaced with live weekly support and is ideal for career changers who want to learn at their own pace.

The CND + CEH Bootcamp is offered in partnership with EC-Council University and prepares students for careers in cybersecurity with three industry-recognized certifications - CND, E|CIH and CEH.

Contact the admissions team to learn more about our bootcamps: admissions@evolvesecurity.com