Overview

This lab demonstrates the detection of suspicious SMB authentication attempts against a Windows 11 endpoint using Wazuh as a SIEM platform.

The objective of this activity was to simulate an attacker attempting to access a Windows machine through SMB and verify whether Windows Security logs were generated and successfully forwarded to the Wazuh dashboard.

The attack simulation was performed from a Kali Linux attacker machine against a Windows 11 victim machine.

Lab Environment

Machine	Role	IP Address
Kali Linux	Attacker Machine	192.168.109.128
Windows 11	Victim Endpoint	192.168.109.133
Ubuntu Server (Wazuh)	SIEM / Log Monitoring	192.168.109.130

Tools Used

Kali Linux
Windows 11 Security Event Logs
Wazuh SIEM
smbclient

Objective

The objective of this test was to:

Simulate an SMB authentication attack.
Generate Windows Security Event Logs.
Verify that Wazuh successfully collects and analyzes the logs.
Validate the detection visibility from an analyst perspective.

Attack Simulation

Step 1: Verify SMB Availability

Before performing the authentication test, SMB availability was checked from the Kali Linux attacker machine.