Splunk SIEM Threat Detection Lab

Architecture

Setup — from zero to ingesting

10 validated detections

Each one below was actually triggered on the live endpoint, queried with real SPL, and captured — not written from documentation.

MEDIUM · T1110

1. Brute-force login burst

Generated 8 failed authentication attempts against localhost with a bad user/password over SMB.

index=endpoint sourcetype="XmlWinEventLog:Security" earliest=-15m ("4625" OR "siem_bad_user")
| stats count as failed_logins by host sourcetype

Result: failed_logins: 10 on DESKTOP-3VSDOLU.

HIGH · T1059.001

2. Suspicious PowerShell execution

Ran powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand ... — a classic malware delivery pattern.

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-15m
("powershell.exe" OR "pwsh.exe") ("EncodedCommand" OR "ExecutionPolicy Bypass")
| table _time host EventCode Image CommandLine ParentImage User

Result: 39 Sysmon events matched.

HIGH · T1110 + T1078

3. Successful login after failed attempt

Created a local test account, generated a failed network logon, then authenticated successfully — the pattern that separates a lockout from an actual compromise.

Result: failed_logons: 1, successful_logons: 1, explicit_credential_events: 2, src_ip: 127.0.0.1.

CRITICAL · T1098 / T1136.001 / T1078

4. Local privilege escalation

Created a local user and added it to the local Administrators group — event IDs 4720 (user created) and 4732 (added to Administrators) correlated by SID.

HIGH · T1071.004 + T1059.001

5. Beacon-style outbound connection

Generated 8 repeated outbound connections from PowerShell to 8.8.8.8:53 to model beacon behavior — threshold set at ≥5 connections to flag.

Result: beacon_connections: 8, process powershell.exe, user DESKTOP-3VSDOLU\omarb.

HIGH · T1053.005

6. Scheduled task persistence

Created a lab scheduled task via schtasks.exe — a common persistence mechanism.

HIGH · T1543.003

7. Windows service installation

Created a lab Windows service (SIEMLabService) — detected via System log event 7045.

HIGH · T1105 + T1218

8. Certutil LOLBin download

Used certutil.exe -urlcache to fetch a benign public page — a well-known "living off the land" technique for downloading payloads with a trusted binary.

SOC dashboard

Consolidated the validated detections into an analyst-ready dashboard: event volume by sourcetype, failed logons, suspicious PowerShell activity, privilege escalation events, persistence/service installation events.

Scheduled alerts

Three recurring alerts configured — 15-minute search window, run every 15 minutes, trigger when results > 0: SOC - Failed Login Burst, SOC - Local Admin Group Membership Change, SOC - Certutil LOLBin Download.

Multi-stage attack-chain correlation

Built a correlated scenario linking authentication, credential use, account creation, admin group membership, and scheduled task persistence into one incident timeline — the kind of correlation a single detection alone can't show.

Cloud IAM case study — extending the lab beyond a single host

Added a cloud identity case using a Splunk-ingestable CSV dataset: identifying repeated failed cloud sign-ins across multiple countries, followed by a successful sign-in.

Result: finance.user@contoso-lab.local — 7 failed sign-ins across 7 countries (DE, FR, GB, MA, NL, SG, US), then 1 successful sign-in. MFA status not_started/satisfied, risk levels high/medium.

Key lessons

• Splunk Cloud forwarders require the Splunk Cloud credentials package specifically — not just the standard forwarder install.
• Windows Security, PowerShell, and Sysmon telemetry alone are enough to build practical SOC-grade detections.
• A CSV-based identity dataset can extend a free lab into cloud/IAM investigation without a paid tenant.
• XML event logs often need explicit SPL rex extraction — fields aren't always parsed automatically.
• Multi-stage correlation gives real investigation context that isolated single-event detections can't.