Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
A Windows process injection loader combining PPID spoofing, manual DLL mapping, module stomping, and direct NT syscall
Wazuh - Docker containers
Plugins for Wazuh Dashboard
A Purple Team lab simulating Active Directory attacks (Kerberoasting, BloodHound, lateral movement) and implementing defensive hardening (gMSA, tiering, LLMNR/NetBIOS disabling) with Wazuh SIEM detection rules mapped to MITRE ATT&CK.