Detection Engineering Lab: Building a Wazuh SIEM and Writing a Custom Rule for SSH Brute Force
This write-up documents a small SIEM detection lab I built to practise detection engineering from the defender's side: deploying a SIEM, generating adversary activity against a monitored host, validating that it is detected, and writing a custom correlation rule mapped to MITRE ATT&CK. Repository with the rule, configuration notes and all screenshots:…
This article details a hands-on SIEM detection lab designed to teach defenders the end-to-end process of deploying a Security Information and Event Management (SIEM) system, simulating adversary activity, validating detection capabilities, and writing custom correlation rules tied to MITRE ATT&CK techniques.
The lab utilizes three virtual machines on a bridged network: a Wazuh manager serving as the SIEM, an Ubuntu endpoint with OpenSSH and Apache hosting the Wazuh agent, and a Kali Linux machine acting as the adversary simulation host. Logs from the endpoint are collected by the Wazuh agent and forwarded to the manager for decoding, evaluation against the rule set, and indexing for display on the dashboard.
Two detection scenarios are examined:
1. SSH brute-force attacks against the SSH service on the endpoint, using Hydra from the Kali host to trigger Wazuh rule 5760 (ssh: authentication failed). The event details provide critical information for analyst investigation.
2. Network reconnaissance, detected through Apache access logs from Nmap port scanning the endpoint. The Nmap script engine requests non-existent URLs, producing 404 responses that trigger Wazuh's web-based rule (31101). The log includes Nmap's user agent for easy attribution of the tool.
To improve detection beyond the vanilla Wazuh rules, the article walks through creating a custom correlation rule that fires when a specific SSH brute-force rule (5760) triggers five times within 120 seconds. This helps filter out normal operational noise and focus on suspicious activity bursts. The rule is then tested against the simulated Hydra attacks.
The lab also uncovers a false positive from Wazuh's rootcheck signature flagging certain system binaries. This false positive is attributed to a generic string pattern match and not indicative of actual compromise. The author recommends documenting and implementing scoped exceptions for known false positives instead of disabling the rule outright.
The article concludes by outlining next steps and extensions for the lab, such as tightening the custom brute-force rule to trigger only from a single source IP, adding automated response capabilities to block offending IPs, expanding coverage to include additional MITRE ATT&CK techniques, and implementing further tuning and exception management. Standing up a SIEM and manually generating adversary activity provides a concrete, practical approach to learning and practicing detection engineering concepts.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
