Mini-SOC: MITRE ATT&CK Investigations
Full documentation of 5 incident investigations on an open-source Mini-SOC
(Wazuh + TheHive), each one reconstructed from the raw alert all the way to the kill chain and
the MITRE ATT&CK mapping. Scenarios are triggered in a controlled test environment -
including an SSH brute-force scenario generated by a purpose-built script
(bruteforce.sh, 15 attempts via sshpass) - then analyzed like real
incidents.
The 5 investigations
- INC-01 - Multi-source SSH brute force: triggered Wazuh rules 5760/5763/2502, multi-IP correlation, mapped to MITRE T1110.001 (Password Guessing).
- INC-02 - Sensitive file read: the initial alert was worked and documented as a false positive - deliberately included to show the qualification process, not just the true positives.
- INC-03 - Backdoor account creation: reconstructed the original
command from the
PROCTITLEfield, hex-encoded in the audit logs, traced back to the account-creation action. - INC-04 - Base64-obfuscated PowerShell: decoded the payload, mapped to MITRE T1059.001 (PowerShell), T1027 (obfuscation), T1105 (tool transfer).
- INC-05 - EICAR malware drop: detected the drop of the standard EICAR test file, MITRE T1105, verified the SOC's antivirus/EDR detection chain.
Methodology
Every case follows the same report structure: triggered alert (Wazuh rule), evidence gathering (logs, processes, connections), kill chain reconstruction, MITRE ATT&CK mapping, then a conclusion (true positive / false positive) with justification. The 5 reports are accompanied by a Mini-SOC architecture document and a set of custom Wazuh rules written specifically for this project, on top of the default rule set.