Skip to content

Back to the catalog

Creating a Red & Blue Team Homelab
hausec.comwriteup

Creating a Red & Blue Team Homelab

A step-by-step guide to building a home lab for practicing both red team (attack) and blue team (detection) skills, covering hardware/hosting choices, standing up a Windows Active Directory domain controller and workstation, deploying an ELK (Elasticsearch, Logstash, Kibana) stack on Debian for log analysis, and shipping Windows event logs (including Sysmon and PowerShell logging) to it via Winlogbeat. It's aimed at aspiring pentesters and threat hunters who want a safe environment to generate TTPs and study the resulting IOCs/detections.

TL;DR Tutorial for standing up an AD + ELK + Sysmon/Winlogbeat homelab to practice red and blue team TTPs.
Open original ↗

Technologies named here

Techniques named here

  • TTP testing in a home lab
  • Threat hunting via log analysis
  • Domain privilege escalation setup
  • Active Directory domain join

Related in Learning