siem-threat-detection-lab — Blue-team SIEM lab: Wazuh 4.7.5 detecting 7 simulated attacks (SSH brute force, Slowloris DoS / CVE-2007-6750, web attacks) with real-time MITRE ATT&CK mapping — 3,726+ alerts. | Kitploit

#	Attack	Tooling	Outcome
1	Port scan	Nmap (`-sS -A`)	Open ports 22 / 80 / 443 discovered
2	SSH brute force	Hydra + rockyou	128 failed logins → brute-force alert
3	Vulnerability scan	Nmap `--script vuln`	Found CVE-2007-6750 (Slowloris)
4	Slowloris DoS	slowhttptest	911 connections held — Apache taken down
5	SSH login loop	bash (50×)	~200 alerts / 30 s spike in Wazuh
6	Web-app attacks	curl	Directory traversal / SQLi / web-shell attempts
7	Successful SSH login	ssh	Valid-account access + post-login enumeration

Technique	Name	Triggered by
T1110	Brute Force	Hydra SSH attack
T1110.001	Password Guessing	Hydra + SSH loop
T1021.004	Remote Services: SSH	SSH login attempts
T1078	Valid Accounts	Successful SSH login
T1021	Remote Services	Post-login activity

SIEM Server	Ubuntu 26.04 LTS	Wazuh 4.7.5 + OpenSearch
Attacker	Kali Linux 2026.2	Attack simulation

Metric	Value
Total security alerts	3,726+
Authentication failures	131
CVEs discovered	1 (CVE-2007-6750)
Slowloris peak connections	911
Alert spike (SSH loop)	~200 alerts / 30 s
MITRE ATT&CK techniques	5

Most Popular

siem-threat-detection-lab

⚔️ Attacks Simulated & Detected

📊 Detection Results

🎯 MITRE ATT&CK Coverage

🔧 Key Findings & Recommended Fixes

💡 Lessons Learned

📄 Full Report