/DetectionLab

Vagrant & Packer scripts to build a lab environment complete with security tooling and logging best practices

Primary LanguageHTMLMIT LicenseMIT

Detection Lab

CircleCI: CircleCI

Purpose

This lab has been designed with defenders in mind. Its primary purpose is to allow the user to quickly build a Windows domain that comes pre-loaded with security tooling and some best practices when it comes to system logging configurations. It can easily be modified to fit most needs or expanded to include additional hosts.

Read more about Detection Lab on Medium here: https://medium.com/@clong/introducing-detection-lab-61db34bed6ae

NOTE: This lab has not been hardened in any way and runs with default vagrant credentials. Please do not connect or bridge it to any networks you care about. This lab is deliberately designed to be insecure; the primary purpose of it is to provide visibility and introspection into each host.

Primary Lab Features:

  • Splunk forwarders are pre-installed and all indexes are pre-created. Technology add-ons for Windows are also preconfigured.
  • A custom Windows auditing configuration is set via GPO to include command line process auditing and additional OS-level logging
  • Palantir's Windows Event Forwarding subscriptions and custom channels are implemented
  • Powershell transcript logging is enabled. All logs are saved to \\wef\pslogs
  • osquery comes installed on each host and is pre-configured to connect to a Fleet server via TLS. Fleet is preconfigured with the configuration from Palantir's osquery Configuration
  • Sysmon is installed and configured using SwiftOnSecurity’s open-sourced configuration
  • Mitre's Caldera server is built on the logger host and the Caldera agent gets pre-installed on all Windows hosts
  • All autostart items are logged to Windows Event Logs via AutorunsToWinEventLog
  • SMBv1 Auditing is enabled

Requirements

  • 55GB+ of free disk space
  • 16GB+ of RAM
  • Packer 1.0.0 or newer
  • Vagrant 1.9.2 or newer
  • Virtualbox or VMWare Fusion/Workstation

This lab has been successfully tested on:

OS Vagrant Packer Provider
OSX 10.12.4 1.9.3 1.0.0 Virtualbox (5.1.14)
OSX 10.12.6 2.0.1 1.1.2 Virtualbox (5.1.30)
OSX 10.12.4 1.9.2 1.0.0 VMWare Fusion (8.5.6)
OSX 10.12.5 1.9.3 1.0.0 VMWare Fusion (8.5.8)
OSX 10.12.6 2.0.1 1.1.3 VMWare Fusion (8.5.9)
OSX 10.12.6 2.0.1 1.1.3 VMWare Fusion (8.5.10)
Ubuntu 16.04 2.0.1 1.1.3 Virtualbox (5.1)

Known Bad Versions:

  • Packer 1.1.2 will fail to build VMWare-ISOs correctly due to this issue.

Quickstart

DetectionLab now contains build scripts for *NIX and MacOS users!

There are two build scripts:

  • build.sh - Builds the entire lab from scratch. Takes 3-5 hours depending on hardware resources and bandwidth
  • build_vagrant_only.sh - Downloads pre-built Packer boxes from S3 and builds the lab from those boxes. This option is recommended if you have more bandwidth than time.

Building from Scratch

  1. Determine which Vagrant provider you want to use.

NOTE: If you have more bandwidth than time, you can skip the building of the Packer boxes and download the boxes directly from S3 and put them into the Boxes directory:

Provider Box URL MD5 Size
Virtualbox Windows 2016 https://www.detectionlab.network/windows_2016_virtualbox.box 614f984c82b51471b5bb753940b59d38 6.4GB
Virtualbox Windows 10 https://www.detectionlab.network/windows_10_virtualbox.box 30b06e30b36b02ccf1dc5c04017654aa 5.8GB
VMware Windows 2016 https://www.detectionlab.network/windows_2016_vmware.box 1511b9dc942c69c2cc5a8dc471fa8865 6.7GB
VMware Windows 10 https://www.detectionlab.network/windows_10_vmware.box 174ad0f0fd2089ff74a880c6dadac74c 6.0GB

If you choose to download the boxes, you may skip steps 2 and 3. If you don't trust pre-built boxes, I recommend following steps 2 and 3 to build them on your machine.

  1. cd to the Packer directory and build the Windows 10 and Windows Server 2016 boxes using the commands below. Each build will take about 1 hour. As far as I know, you can only build one box at a time.
$ cd detectionlab/Packer
$ packer build --only=[vmware|virtualbox]-iso windows_10.json
$ packer build --only=[vmware|virtualbox]-iso windows_2016.json

  1. Once both boxes have built successfully, move the resulting boxes (.box files) in the Packer folder to the Boxes folder:

    mv *.box ../Boxes

  2. cd into the Vagrant directory: cd ../Vagrant

  3. Install the Vagrant-Reload plugin: vagrant plugin install vagrant-reload

  4. Ensure you are in the Vagrant folrder and run vagrant up. This command will do the following:

  • Provision the logger host. This host will run the Fleet osquery manager and a fully featured pre-configured Splunk instance.
  • Provision the DC host and configure it as a Domain Controller
  • Provision the WEF host and configure it as a Windows Event Collector in the Servers OU
  • Provision the Win10 host and configure it as a computer in the Workstations OU
  1. Navigate to https://192.168.38.5:8000 in a browser to access the Splunk instance on logger. Default credentials are admin:changeme (you will have the option to change them on the next screen)
  2. Navigate to https://192.168.38.5:8412 in a browser to access the Fleet server on logger. Default credentials are admin:admin123#. Query packs are pre-configured with queries from palantir/osquery-configuration.
  3. Navigate to https://192.168.38.5:8888 in a browser to access the Caldera server on logger. Default credentials are admin:caldera.

Basic Vagrant Usage

Vagrant commands must be run from the "Vagrant" folder.

  • Bring up all Detection Lab hosts: vagrant up (optional --provider=[virtualbox|vmware_fusion|vmware_workstation])
  • Bring up a specific host: vagrant up <hostname>
  • Restart a specific host: vagrant reload <hostname>
  • Restart a specific host and re-run the provision process: vagrant reload <hostname> --provision
  • Destroy a specific host vagrant destroy <hostname>
  • Destroy the entire Detection Lab environment: vagrant destroy (Adding -f forces it without a prompt)
  • SSH into a host (only works with Logger): vagrant ssh logger
  • Check the status of each host: vagrant status
  • Suspend the lab environment: vagrant suspend
  • Resume the lab environment: vagrant resume

Lab Information

Lab Hosts

  • DC - Windows 2016 Domain Controller
    • WEF Server Configuration GPO
    • Powershell logging GPO
    • Enhanced Windows Auditing policy GPO
    • Sysmon
    • osquery
    • Splunk Universal Forwarder (Forwards Sysmon & osquery)
    • Sysinternals Tools
  • WEF - Windows 2016 Server
    • Windows Event Collector
    • Windows Event Subscription Creation
    • Powershell transcription logging share
    • Sysmon
    • osquery
    • Splunk Universal Forwarder (Forwards WinEventLog & Powershell & Sysmon & osquery)
    • Sysinternals tools
  • Win10 - Windows 10 Workstation
    • Simulates employee workstation
    • Sysmon
    • osquery
    • Splunk Universal Forwarder (Forwards Sysmon & osquery)
    • Sysinternals Tools
  • Logger - Ubuntu 16.04
    • Splunk Enterprise
    • Fleet osquery Manager
    • Mitre's Caldera Server

Splunk Indexes

Index Name Description
osquery osquery/Fleet result logs
osquery-status osquery/fleet INFO/WARN/ERROR logs
powershell Powershell transcription logs
sysmon Logs from the Sysmon service
wineventlog Windows Event Logs

Installed Tools on Windows

  • Sysmon
  • osquery
  • AutorunsToWinEventLog
  • Caldera Agent
  • Process Monitor
  • Process Explorer
  • PsExec
  • TCPView
  • Google Chrome
  • Atom editor
  • WinRar
  • Mimikatz

Applied GPOs

Known Issues and Workarounds

Vagrant has been particularly flaky with VMWare and I encountered many issues while testing. However, most of the issues are easily resolved.

Issue: Vagrant reports: Message: HTTPClient::KeepAliveDisconnected: while provisioning.
Workaround: Run $ vagrant reload <hostname> --provision

Issue: Vagrant timed out while attempting to connect via WinRM after Win10 host joins the domain.
Workaround Documented in #21. Just run $ vagrant reload win10 --provision

Issue: Vagrant is unable to forward a port for you
Workaround: Documented in #11. There are a few possibilities:

  1. Try a vagrant reload <hostname> --provision. For whatever reason vagrant up doesn't fix conflicts but reload does.
  2. Check if something is legitimately occupying the port via sudo lsof -n -iTCP:<port_number>
  3. Follow the instructions from this comment: hashicorp/vagrant#8130 (comment)

Issue: Fleet server becomes unreachable after VM is suspended and resumed

Workaround: Documented in #22. The following commands should make it reachable without deleting data:

$ docker stop $(docker ps -aq)
$ service docker restart
$ cd /home/vagrant/kolide-quickstart
$ docker-compose up -d

Issue: Your primary hard drive doesn't have enough space for DetectionLab

Workaround: Documented in #48. You can change the default location for Vagrant by using the VAGRANT_HOME environment variable.

Contributing

Please do all of your development in a feature branch on your own fork of detectionlab. Requests for tools and features will be reviewed on a case by case basis, but I will always accept fixes and improvements.

Credits/Resources

A sizable percentage of this code was borrowed and adapted from Stefan Scherer's packer-windows and adfs2 Github repos. A huge thanks to him for building the foundation that allowed me to design this lab environment.

Acknowledgements