By Mahmoud | Cybersecurity Enthusiast & SOC Analyst in Training
"The best way to understand how attacks are detected is to be the one running them."
Imagine you're a security analyst. It's 2 AM. An alert fires.
[HIGH] Password Spraying Detected
Source: 192.168.1.31
Targets: user1, user2, user3, user4, user5
Time: 23:38:04
You open Splunk. You see the logs. You trace the path. You understand exactly what the attacker did, where they are in the kill chain, and what they're about to do next.
That's the goal of Part 3.
In Part 1 and 2, we built the foundation — Splunk receiving logs, Sysmon watching every process, first detections firing. Now we go deeper. We're building an Active Directory environment, simulating real enterprise attacks, and building the detections that actually matter in a SOC job.
By the end of this, you'll have run five attacks against your own lab, caught every single one, and understood why each one works the way it does.
Let's break things — on purpose.
Here's a number that should surprise you: over 90% of Fortune 500 companies run Active Directory.
When a real attacker gets inside a corporate network, they're not looking for random files. They're looking for credentials. And credentials in Windows environments live in Active Directory — usernames, passwords (hashed), service accounts, permissions, group memberships. Everything.
The three most common techniques used in real breaches involve AD: