A structured attack-and-detect research lab built on Metasploitable 2, documenting real exploitation chains alongside detection artifacts for each service.
This is not a CTF writeup repository. The goal is to build the muscle for thinking offensively and defensively at the same time the same muscle a detection engineer, threat hunter, or red teamer needs in practice.
Every entry follows the same loop:
Attack → Detect → Document → Publish
| Component | Detail |
|---|---|
| Attacker | Kali Linux — 192.168.75.129 |
| Target | Metasploitable 2 — 192.168.75.130 |
| Network | VMware host-only |
| IDS | Suricata 8.0.5 |
| SIEM | Wazuh 4.7.0 (Docker) |
| Host | AMD Ryzen 7 8845HS, 16GB DDR5, RTX 4050 |
Medium links will be updated as posts go live.
Here is Medium Profile for detailed attack procedure : https://medium.com/@PranavVerma
Every attack note follows a consistent structure:
- Service and version — what's running and why it matters
- Exploitation chain — exact commands, no hand-waving
- Attacker mindset — why an attacker targets this service, what they're after
- Detection opportunity — where in the chain defenders can catch it
- Sigma rule reference — link to the corresponding rule in this repo
The notes are written as technical references, not tutorials. They assume you know how to operate the tools.
Rules are written against real log sources from this lab:
- Wazuh agentless
ssh_generic_diffmonitoring/var/log/auth.logon Metasploitable - Suricata
eve.jsonfor network-layer detection - Syslog for service-specific events
Each rule documents the detection gap context — where Suricata's default ET-Open ruleset missed, and why a custom rule was necessary. Known limitations are stated explicitly rather than glossed over.
Part of doing this honestly is documenting what doesn't work:
- Wazuh agentless
ssh_generic_diffhas zero visibility into in-process command execution. It detects file changes, not commands run in active sessions. This is an architectural gap, not a configuration error. - Suricata ET-Open fired zero alerts across most attack chains in this lab. Default rulesets are tuned for generic internet traffic, not controlled lab exploitation — custom rules are mandatory for meaningful coverage.
- Port 6667 Sigma rule was published before full validation against real
eve.jsonfield structure — flagged as a gap pending re-validation.
Each port follows the PTES (Penetration Testing Execution Standard) phases:
Reconnaissance → Scanning → Exploitation → Post-Exploitation → Detection → Documentation
The detection layer runs concurrently — Suricata and Wazuh are live during every attack chain, and gaps in their coverage are treated as findings, not failures.
Pranav verma
(TURLA)
"The best way to learn detection is to build the attack first."