Defensive research labs

Built to prove detection quality—not just demonstrate tooling.

CipherNest labs turn security concepts into repeatable exercises. Each environment pairs controlled attack simulation with telemetry, rule logic, MITRE ATT&CK context, and the investigation steps a defender actually needs.

Open defender resources

Lab catalogue

Controlled environments for serious defender practice.

Every lab keeps the chain of evidence visible: what was simulated, what was observed, how it was detected, and where the method needs more work.

Foundation lab

Telemetry Baseline

Build a dependable view of endpoint, identity, and network activity before detections are written.

Architecture: Windows and Linux endpoints → collection pipeline → Wazuh/SIEM → analyst triage views
Simulation: Authenticated discovery, service enumeration, and suspicious PowerShell execution.

MITRE ATT&CK coverage

TA0007 DiscoveryT1059 Command and Scripting InterpreterT1087 Account Discovery

Working artifacts

Collection notes · Event field map · Triage runbook

Detection lab

Attack-to-Alert

Validate that a behavior-driven detection produces enough context for a first-pass investigation.

Architecture: Atomic-style simulation → normalized events → rule logic → alert enrichment → case notes
Simulation: Credential access and lateral-movement simulations executed only in an isolated lab boundary.

MITRE ATT&CK coverage

TA0006 Credential AccessT1021 Remote ServicesT1078 Valid Accounts

Working artifacts

Sigma rule · Detection query · False-positive analysis

Hunting lab

Investigation Replay

Turn a suspicious sequence into a documented hunt that can be repeated as new evidence arrives.

Architecture: Curated logs → hypothesis queue → pivots and joins → evidence timeline → lessons learned
Simulation: Living-off-the-land execution and persistence patterns reconstructed from controlled test data.

MITRE ATT&CK coverage

TA0003 PersistenceT1547 Boot or Logon AutostartT1218 System Binary Proxy Execution

Working artifacts

Hunt hypothesis · Query workbook · MITRE coverage notes

Method

A lab only earns trust when the path is reproducible.

Tool output alone is not evidence of readiness. The lab process is designed to make assumptions reviewable and detection outcomes easier to improve over time.

State the defender question and the decision the signal should support.
Model the relevant adversary behavior and establish a safe simulation boundary.
Capture evidence, normalize fields, and write the smallest useful detection.
Replay, tune, document limitations, and preserve the analyst workflow alongside the rule.

Safety by design

No live targeting. No ambiguous boundaries.

Simulations are constrained to owned, isolated environments. The goal is safer learning and stronger detection engineering—not spectacle or unsanctioned activity.

Discuss a lab

Telemetry Baseline

Build a dependable view of endpoint, identity, and network activity before detections are written.

Architecture

Windows and Linux endpoints → collection pipeline → Wazuh/SIEM → analyst triage views

Simulation

Authenticated discovery, service enumeration, and suspicious PowerShell execution.

MITRE ATT&CK coverage

TA0007 DiscoveryT1059 Command and Scripting InterpreterT1087 Account Discovery

Working artifacts

Collection notes · Event field map · Triage runbook

Attack-to-Alert

Validate that a behavior-driven detection produces enough context for a first-pass investigation.

Architecture

Atomic-style simulation → normalized events → rule logic → alert enrichment → case notes

Simulation

Credential access and lateral-movement simulations executed only in an isolated lab boundary.

MITRE ATT&CK coverage

TA0006 Credential AccessT1021 Remote ServicesT1078 Valid Accounts

Working artifacts

Sigma rule · Detection query · False-positive analysis

Investigation Replay

Turn a suspicious sequence into a documented hunt that can be repeated as new evidence arrives.

Architecture

Curated logs → hypothesis queue → pivots and joins → evidence timeline → lessons learned

Simulation

Living-off-the-land execution and persistence patterns reconstructed from controlled test data.

MITRE ATT&CK coverage

TA0003 PersistenceT1547 Boot or Logon AutostartT1218 System Binary Proxy Execution

Working artifacts

Hunt hypothesis · Query workbook · MITRE coverage notes