Part 1 - Setting Up the Environment
Designed for SOC analysts, it simulates real-world cybersecurity scenarios using LimaCharlie, Sysmon, C2 Framework(sliver-server),
Last updated
Designed for SOC analysts, it simulates real-world cybersecurity scenarios using LimaCharlie, Sysmon, C2 Framework(sliver-server),
Last updated
A computer with at least 8GB RAM
VMware Workstation Pro
Windows 10 VM
Ubuntu Server 22.04.1 ISO (Server version is required, not Desktop)
Download the Ubuntu Server 22.04.1 ISO.
Create a new VM in VMware with the following specs:
Installer image: Ubuntu ISO
Disk size: 20GB
CPU: 2 cores
RAM: 2GB
During installation:
Use default settings unless otherwise stated.
Enable OpenSSH server.
Set a static IP for the Linux VM: A static IP keeps the Linux VM’s address the same, so tools and connections don’t break after a reboot.
Find the NAT network’s gateway IP in VMware:
Click Edit in VMware Workstation.
Open Virtual Network Editor.
Select the NAT network and click NAT Settings.
Copy the Subnet IP & Gateway IP.
Assign an IP within the subnet.
Example:
Address: 192.168.64.100/24
Gateway: 192.168.64.2
Set login credentials:
Your name: user
Server name: attack
Username: user
Password: password
Complete installation:
Reboot when prompted.
If it hangs on "removing the CDROM," press Enter.
Test network connectivity ⇒ ping -c 2 google.com
- If responses return successfully, your setup is working.
Power on the Windows VM for the first time after installing.
It will log you in automatically as user.
Wait for the desktop to appear.
Disable Tamper Protection
Open Windows Security → Virus & threat protection → Manage settings
Disable Defender via Group Policy
Open Command Prompt (Admin) and run:
Navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus
Enable Turn off Microsoft Defender Antivirus.
Disable Defender via Registry
Open Command Prompt (Admin) and run:
Disable Defender Services in Safe Mode
Open Registry Editor (regedit) and set Start values to 4 for:
Open msconfig, uncheck Safe Boot, and restart.
Prevent Standby Mode in the VM
Standby mode can interrupt monitoring, kill connections, and miss suspicious activity. Stay sharp.
Open Command Prompt (Admin) and run:
Why install Sysmon? Sysmon is a powerful tool for monitoring system activity, essential for security analysis. While not mandatory for this guide, it provides deep visibility into Windows events.
Press Win + X, then click Windows PowerShell (Admin) to launch an elevated PowerShell session.
Run the following command to download Sysmon from the official Microsoft Sysinternals site:
After downloading, extract the Sysmon package using:
For better event logging, use a pre-configured Sysmon ruleset from SwiftOnSecurity:
If Sysmon is running, you will see its status as Running.
If logs appear, Sysmon is successfully installed and working!tep 3: Verify Installation
Check if Sysmon is running:
Check event logs:
If you see logs, Sysmon is successfully installed!
LimaCharlie is a powerful SecOps Cloud Platform that provides cross-platform EDR, log shipping, and a threat detection engine. It offers a free tier for up to two systems, making it perfect for this guide.
Sign up for a free LimaCharlie account.
Answer the role-related questions (optional, helps improve their service).
After logging in, create an organization:
Name: Any unique name
Data Residency: Choose the nearest location
Demo Configuration Enabled: Disabled
Template: Extended Detection & Response Standard
Click Add Sensor.
Select Windows.
Provide a description (e.g., Windows VM - Lab).
Click Create.
Select the Installation Key.
Open an Administrative PowerShell prompt in your Windows VM.
Run the following commands:
Switch to Command Prompt:
Copy and paste the installation command from LimaCharlie (contains your key).
Press Enter to install the agent.
Note: If the EXE fails, try installing the x86-64 MSI version.
In LimaCharlie, navigate to Artifact Collection.
Click Add Rule.
Configure the rule:
Name: windows-sysmon-logs
Platforms: Windows
Path Pattern: wel://Microsoft-Windows-Sysmon/Operational:*
Retention Period: 10
Click Save Rule.
LimaCharlie will now collect Sysmon logs, providing detailed telemetry alongside its EDR data.
Before proceeding, create a snapshot of your Windows VM. This ensures you can revert to a clean state if needed.
You're now ready to move on to setting up the Linux VM!
We will run Sliver, a tool used for cybersecurity testing. We’ll do this by connecting to an Ubuntu VM using SSH from your main computer.
An Ubuntu VM with a fixed IP address.
An SSH client (Windows CMD, PowerShell, Linux Terminal, or PuTTY).
An Internet connection to download Sliver.
Open a command prompt or terminal on your computer.
Type the following command, replacing [Linux_VM_IP] with your VM’s actual IP:
Press Enter and log in.
To avoid permission issues, switch to the root user:
Run these commands one by one:
To keep things organized, create a folder for Sliver:
Sliver is now installed! In the next steps, we’ll deploy a C2 payload on a Windows VM and use Sysmon and LimaCharlie to monitor its activity.
Turn OFF Tamper Protection and all other security options.
Open msconfig, go to Boot tab, check Safe Boot, and restart.
Choose the x86-64 (.exe) sensor (ignore LC’s instructions and follow these instead).
Check if the sensor appears in the LimaCharlie web UI.
