hMailServer Alert Test
Testing my own hMailServer failed-login detection: eleven failed logins from a Thunderbird client raise Wazuh rules 100321 and 100322, open a LabWatch incident, and get triaged step by step.
Homelab environment
3 physical hosts · 8 VMsI built an enterprise network simulation containing an Active Directory domain, 2 Windows 11 endpoints, a web server and SQL database, a dual-SIEM hosting Splunk and Wazuh, and a Kali VM for adversary emulation, plus an Ubuntu C2 server that is currently parked. I use this to construct realistic attack/defend scenarios and produce my own incident response documentation.
Read the homelab walkthrough →
LABHV
Enterprise
Windows 11 Host · VMware Workstation
BLUETEAM
Detection
Windows 11 Host · VMware Workstation
ATTACKBOX
Adversary
Windows 11 Host · VMware Workstation
| VM | Role | Platform | Core technologies |
|---|---|---|---|
| DC01 | Identity and directory | Windows Server 2022 | AD DS · DNS · Kerberos |
| SRV01 | Application services | Windows Server 2022 | IIS/PHP · MySQL · hMailServer |
| WS01 / WS02 | Instrumented endpoints | Windows 11 | Sysmon · Wazuh · Velociraptor |
| SIEM01 | Detection and DFIR | Ubuntu 26.04 | Wazuh · Velociraptor · Splunk Universal Forwarder |
| SIEM02 | Analytics and decision layer | Ubuntu 26.04 | Splunk Enterprise · Wazuh · Velociraptor |
| KALI | Adversary emulation | Kali Linux | Nmap · Impacket · NetExec · BloodHound |
| C2-01 | Isolated control plane (parked) | Ubuntu 26.04 | Sliver |
Latest
2026-092026-09-30T1110.001~8 min
2026-09-11DFIR~6 min
Roll the Dice: INC-2026-0038
The first round of a homelab exercise: Claude Code injects a real fault and files a ticket, and I work it blind as a live incident. One workstation cannot reach an internal web app while every other host and port is fine. The cause is a single outbound firewall rule, found by listing rules on what I knew instead of a guessed name and pinned to its port and address by a shared InstanceId.
2026-09-08Homelab~47 min
Homelab Walkthrough
A walkthrough of my eleven-system SOC homelab, from physical hosts and Active Directory to Wazuh, Velociraptor, Splunk, Sliver, and LabWatch incident response.
2026-09-02T1558~18 min
AS-REP+Kerberoasting 1
AS-REP roasting and AES Kerberoasting captured from KALI, traced through DC01 events, detected in Wazuh, inspected in Wireshark, and tested with offline cracking.
2026-08-16T1219~15 min
One RMM Is IT. Two Is An Incident.
One remote-access tool on a machine is normal; every managed service provider has one. The useful question is whether a second one showed up and whether the first one put it there. Four Wazuh rules built and fired against a live workstation, and the vendor-list gap that made the rule miss a real campaign.
2026-08-02DFIR~6 min
Installing Velociraptor in My Homelab
The service came up on the first try, then I deleted it and rebuilt it because I could not have said what half of it was doing. Two version-pinned traps, including a config generator offering to write private keys onto a network share.