Adaptive Cyber Defense: Realistic SOC Workflow Implementation

This project simulates the complete cybersecurity attack and defense lifecycle within a controlled virtual environment using Kali Linux and Windows 10, alongside tools such as Metasploit, Sysmon, and Splunk. Virtual machines are deployed in VirtualBox on an isolated internal network, ensuring safe and realistic network interactions. The simulation begins with reconnaissance using Nmap to identify potential vulnerabilities, followed by payload creation in Metasploit to establish unauthorized access via a reverse shell. Defensive strategies include the deployment of Sysmon for detailed system activity logging and the use of Splunk for real-time monitoring and alert generation. This setup effectively replicates real-world attack scenarios and demonstrates the importance of proactive detection, incident response, and continuous monitoring. The project concludes with recommendations for enhancing organizational security postures through integrated threat detection and regular simulation exercises. By combining offensive and defensive methodologies in a hands-on lab, this work offers a practical framework for cybersecurity training and reinforces the need for adaptive defense strategies in today's evolving threat landscape.