🧠 Technologies & Skills Used

• Microsoft Azure Resources: Network Security Groups, Virtual Machines, Virtual Networks
• Security Monitoring Tools: Microsoft Sentinel SIEM, Log Analytics Workspace
• Log Analysis: KQL (Kusto Query Language), Security Event Log Analysis
• Security Concepts: Honeypot Deployment, Security Baseline Violation (deliberate), Attack Surface Management

📑 Table of Contents

🛠️ Creating the Resource Group, VNET, & Virtual Machine

🍯 Intentionally Making the Virtual Machine Vulnerable

🪵 Exploring Logs

📩 Forwarding Logs to Azure Configuration

🔎 Analyzing Log Data with KQL

📍 Tracking GeoIP

🌍 World Map of Attacker Location Configuration

🗺️ Visualization of Attack Location Data (Attack Map)

🛠️ Creating Microsoft Azure Resources (RG, VM, VNET)

📂 Creating the Resource Group

🌐 Creating the VNET

Basics Tab:

1. Virtual network name: Enter VNET-SOC-Lab
2. Resource group: RG-SOC-Lab
3. Region: US East 2

🖥️ Creating Virtual Machine (Honeypot)

Basics Tab:

1. Resource group: RG-SOC-Lab
2. Virtual machine name: Enter CORP-NET-EAST

Note

Avoid using 'honeypot' in the name, as attackers might identify the VM’s purpose and avoid targeting it

3. Region: US East 2
4. Image: Windows 10 Pro, version 22H2 - x64 Gen2
5. Size: Standard_D2s_v3 - 2 vcpus, 8 GiB memory
6. Administrator account: Enter secure credentials
7. Tick ✅I confirm I have an eligible Windows 10/11 license with multi-tenant hosting rights

Disks Tab: OS disk type: Standard HDD (locally-redundant storage)

Networking Tab: Virtual network: VNET-SOC-Lab Tick ✅Delete public IP and NIC when VM is deleted

Monitoring Tab: Boot diagnostics: Tick ✅Disable

Review + Create Tab: Click the blue Create button

🍯 Intentionally Making the Virtual Machine Vulnerable

After the RG, VM, and VNET are created, the populated resource group should look like this—

🚦Delete Current RDP Inbound Rule & Create a Vulnerable One

From here, open up CORP-NET-EAST-nsg

Delete the RDP inbound security rule:

On the side panel on the left, navigate to Settings > Inbound security rules > + Add with the following settings—

Destination port ranges: * Name: DANGER_AllowAnyCustomAnyInbound

🧱 Sabotage Windows Defender Firewall Settings

1. Remotely access the CORP-NET-EAST virtual machine using the Remote Desktop Connection Windows application

2. Open wf.msc by searching for it in the search bar. When the Windows Defender Firewall with Advanced Security window appears, click Windows Defender Firewall Properties

3. On the Domain Profile tab, press the 'O' key and the desired settings will change. Repeat this process for the Private Profile and Public Profile tabs. Click Apply and OK

4. Disconnect from the CORP-NET-EAST virtual machine

🏓 Ping the Virtual Machine from a Third-party Machine

🪵 Exploring Logs

🔑 Deliberately Fail RDP Log-in & Observe the Corresponding Logs

1. Attempt to remotely access the CORP-NET-EAST virtual machine by using incorrect credentials 4 times

2. Remotely access the CORP-NET-EAST virtual machine with the legitimate credentials and open Event Viewer, and navigate to Windows Logs > Security > Find…

3. In the Find pop-up window, search for 4625 which is the event ID for failed log-in attempts

4. Observe the four failed log-in attempts from step 1 by double clicking them (below, it shows that DREWS_PC attempted a connection with the IP address of the VPN I'm currently connected to)

📩 Forwarding Logs to Azure Configuration

1. In portal.azure.com, search for Log Analytics workspaces, click + Create log analytics workspace button, set the Resource group to RG-SOC-Lab, set the Name to LAW-SOC-Lab-000, click Review + Create, and click Create after the validation completes

2. In portal.azure.com, search for Microsoft Sentinel, click + Create Microsoft Sentinel, add Microsoft Sentinel to the LAW-SOC-Lab-000 workspace

3. In Microsoft Sentinel, within the LAW-SOC-Lab-000 workspace, navigate to Content management > Content hub, and in the search for Windows Security Events in the Search… box

4. Tick ✅ Windows Security Events and then click the blue Install button in the panel on the right

5. When the install completes, click the blue Manage button that's where the Install button used to be

6. Tick ✅ Windows Security Events via AMA and then click the blue Open connector page button in the panel on the right

7. Click +Create data collection rule and use the following settings

Basics Tab: Set the Rule name to DCR-Windows and use the RG-SOC-Lab Resource group,

Resources Tab: Expand Azure subscription 1 > RG-SOC-Lab > and tick ✅ CORP-NET-EAST

Review + Create: Click the blue Create button

8. In the CORP-NET-EAST virtual machine, navigate to Settings > Extensions + applications to observe that AzureMonitorWindowsAgent is now in the Transitioning phase (eventually it should turn into Provisioning succeeded)

9. In portal.azure.com, search for Log Analytics workspaces, select LAW-SOC-Lab-000, and click on the Logs tab, type SecurityEvent into the textbox, and click ▶ Run. At first, there shouldn't be many records. However, after I leave the virtual machine on for around 24 hours, I'll come back and analyze that data with KQL and see how many attacks took place.

🔎 Analyzing Log Data with KQL

1. After the 24 hour mark, running this command will let me see how many attacks took place in total:

    SecurityEvent
    | where EventID == 4625
    | count

2. Then, these attacks can be queried to display the attacks with only the relevant information such as time generated, account username, the machine that generated the log, event ID, activity (what the event ID means), and IP address:

    SecurityEvent
    | where EventID == 4625
    | project TimeGenerated, Account, Computer, EventID, Activity, IpAddress

📍 Tracking GeoIP

1. In portal.azure.com, search for Microsoft Sentinel, click LAW-SOC-Lab-000, navigate to Configuration > Watchlist, and click + New

Basics Tab: For the Name and Alias fields, enter geoip

Source Tab: Under Upload file, upload geoip-summarized.csv and set the SearchKey to network

Review + Create Tab: Click the blue Create button

2. The file will begin to upload (when Status (Preview) changes from ♻️Uploading to ✅Succeeded, it's time to proceed)

3. Running the command below will verify that the newly created Watchlist (in the Log Analytics workspace) works properly

    SecurityEvent

    _GetWatchlist("geoip")

4. Use an attacker’s IP address (from the logs) to query the GeoIP Watchlist and map the attack location:

    let GeoIPDB_FULL = _GetWatchlist("geoip");
    let WindowsEvents = SecurityEvent
        | where IpAddress == <insert attacker IP address here>
        | where EventID == 4625
        | order by TimeGenerated desc
        | evaluate ipv4_lookup(GeoIPDB_FULL, IpAddress, network);
    WindowsEvents
    | project TimeGenerated, Computer, AttackerIP = IpAddress, cityname, countryname, latitude, longitude

🌍 World Map of Attacker Location Configuration

1. In portal.azure.com, search for Microsoft Sentinel, click LAW-SOC-Lab-000, navigate to Threat management > Workbooks, click + Add Workbook, and then click Edit

2. Remove the default entries that Azure populates the new Workbook with

3. Click + Add, click Add query, and then move to the Advanced Editor tab

4. Replace the current contents in the Advanced Editor textbox with the following .json snippet

{
	"type": 3,
	"content": {
	"version": "KqlItem/1.0",
	"query": "let GeoIPDB_FULL = _GetWatchlist(\"geoip\");\nlet WindowsEvents = SecurityEvent;\nWindowsEvents | where EventID == 4625\n| order by TimeGenerated desc\n| evaluate ipv4_lookup(GeoIPDB_FULL, IpAddress, network)\n| summarize FailureCount = count() by IpAddress, latitude, longitude, cityname, countryname\n| project FailureCount, AttackerIp = IpAddress, latitude, longitude, city = cityname, country = countryname,\nfriendly_location = strcat(cityname, \" (\", countryname, \")\");",
	"size": 3,
	"timeContext": {
		"durationMs": 2592000000
	},
	"queryType": 0,
	"resourceType": "microsoft.operationalinsights/workspaces",
	"visualization": "map",
	"mapSettings": {
		"locInfo": "LatLong",
		"locInfoColumn": "countryname",
		"latitude": "latitude",
		"longitude": "longitude",
		"sizeSettings": "FailureCount",
		"sizeAggregation": "Sum",
		"opacity": 0.8,
		"labelSettings": "friendly_location",
		"legendMetric": "FailureCount",
		"legendAggregation": "Sum",
		"itemColorSettings": {
		"nodeColorField": "FailureCount",
		"colorAggregation": "Sum",
		"type": "heatmap",
		"heatmapPalette": "greenRed"
		}
	}
	},
	"name": "query - 0"
}

5. Click Done Editing

6. Save the Workbook with the save icon in the toolbar with the Title being Windows VM Attack Map and the Resource group being RG-SOC-Lab (after clicking the blue Save As button, also re-click the save icon in the toolbar)

Note

The map visualization is highly customizable. For example, the color scheme can be adjusted from Green-Orange-Red to Yellow-Orange-Red

🗺️ Visualization of Attack Location Data (Attack Map)