EgeInfoSec

This project provided me with comprehensive, hands-on experience in building and analyzing a complex threat scenario from the ground up, simulating a real-world enterprise environment.

XDR Case Study: Learn Threat Hunting from Scratch

I documented all of the steps I accomplished in this project so you can start from the beginning and do all of the stuff yourself! By following this guide, you can successfully understand what XDR (Extended Detection and Response) is, how to isolate VMs, how to build a SIEM, and more. If you have any questions or suggestions, please send me an email!

---

Core Cybersecurity Skills Demonstrated

This project provided me with comprehensive, hands-on experience in building and analyzing a complex threat scenario from the ground up, simulating a real-world enterprise environment. I mastered foundational skills essential for any modern security role:

• Secure Lab Engineering: Designed and deployed an isolated, enterprise-simulated environment using VirtualBox. I ensured complete network isolation (Host-Only/Internal Networking) between the Attacker, Target, and Security VMs. This included administering Linux servers and troubleshooting connections.
• SIEM/SecOps Proficiency: Built and configured the full Elastic Stack (ELK) from scratch—Elasticsearch, Logstash, and Kibana—to serve as the central Security Information and Event Management (SIEM) platform.
• Log Ingestion & EDR: Configured endpoint forwarders like Winlogbeat (for Windows Sysmon logs) and Filebeat, ensuring robust telemetry collection.
• Advanced Troubleshooting: Developed strong diagnostic skills by resolving complex, persistent failures, including driver conflicts and PowerShell command-line parsing errors.

---

Threat Hunting Scenario: The “Low-and-Slow” Attack

I executed a covert attack simulation to test the environment’s detection capabilities.

Hypothesis: A persistent threat actor establishes stealthy persistence using a native Windows utility and is exfiltrating data via a low-bandwidth, non-standard channel (DNS Tunnelling).

Techniques Identified (MITRE ATT&CK):

• Persistence: Used the Scheduled Task/Job (T1053.005) technique.
• Command & Control / Exfiltration: Used DNS Tunnelling (T1048.003) to create a covert communications channel.

XDR Detection & Correlation

The final stage involved leveraging the SIEM to correlate discrete events—the hallmark of Extended Detection and Response (XDR):

1. Network Anomaly Detection: A KQL query successfully identified recurring traffic on destination port 53 directed toward the Attacker’s IP, confirming the covert DNS Command and Control (C2) channel, which is the T1048.003 technique.
2. Endpoint Persistence Confirmation: I successfully filtered for powershell.exe execution.
3. Forensic Deduction: By correlating the recurring 1-minute execution cadence of powershell.exe with the network traffic, I confirmed that the threat actor established persistence using the Scheduled Task/Job (T1053.005) technique.

This project allowed me to successfully link discrete Endpoint events (PowerShell persistence) with Network anomalies (covert DNS traffic) to complete the XDR kill chain.