Windows Logs (AD01) Securing the Environment and Testing Environment

Cameron Coleman-Willliams — Sat, 12 Sep 2026 16:45:42 +0000

Hi I'm Cameron Coleman-Williams (29)
Looking to get into the Cybersecurity field and this is my first Atomic testing on a system and first few looks at a Wazuh Siem.
This blog will be about my experience on my first Wazuh Siem log studies and Atomic testing
For my Project I wanted to harden my anti-virus and do a few experiments to see if Wazuh Siem was working and telling me everything that I need. I went through a few bumps in my modification and testing.
So let tell you what I was planning to do for my modification first.
I intended to modify the AD01 Windows Defender log to enhance the security of Microsoft Defender Antivirus. To configure the updates, I need to access the Group Policy Management Console (GPMC), expand the Group Policy Objects in the domain, identify the specific GPO I want to edit, and then implement the necessary changes. After that, I will direct all logs to Wazuh for their SIEM, allowing Wazuh to monitor activities and behaviors both before and after the changes are made. I anticipate that this will enable auditing of endpoint activity and that it will analyze security event data to detect any anomalies or indicators of compromise. DDCP is designed for security settings specific to Domain Controllers, including User Rights Assignment and Audit Policy, which are stricter than domain-wide policies to protect critical infrastructure. In contrast, DDP is mainly utilized for domain-wide security settings, particularly account policies such as password length, complexity, lockout thresholds, and Kerberos settings. I enabled both of these in the Group Policy Object (GPO) settings. However, I encountered issues when I used a command (gpupdate) in PowerShell, which I had a few misspelled try's. But afterwards This resulted in the need to now update the antivirus, using Microsoft as a reference.
https://www.microsoft.com/en-us/wdsi/defenderupdates

Configure Microsoft Defender Antivirus with Group Policy - Microsoft Defender for Endpoint | Microsoft Learn
Learn how to use a Group Policy to configure and manage Microsoft Defender Antivirus on your endpoints in Microsoft Defender for Endpoint.
https://learn.microsoft.com/en-us/defender-endpoint/use-group-policy-microsoft-defender-antivirus

the references was great for understanding the Microsoft Defender Anti-virus updates and why, and what its good for.

I found guidance suggesting that I should check my settings for updates and apply them there, followed by restarting my computer. Consequently, I accessed my settings, located four necessary updates, applied them, and after restarting the computer, everything was successful.

Now for my experiments I had a few mess ups as well.
Experiment 1
Microsoft Defender operational logs forwarded malware alerts to the Wazuh platform for functionality verification and operational log review. Detailed, time-stamped records of Microsoft Defender Antivirus and associated security activities are necessary as they assist in monitoring, troubleshooting, and investigating both regular and potential threats. This involves configuring Wazuh agents on Windows endpoints to collect Windows Defender logs. A centralized configuration for the Wazuh agent must be established to allow instructions to be distributed among a group of agents. The goal is to detect vulnerabilities on monitored endpoints, facilitating the remediation process. Custom rules should be set up to ensure maintenance and updates with each product release, enhancing malware detection capabilities. Wazuh is being utilized as it is considered effective for beginners learning to read and monitor endpoint logs. Expectations include key highlights, verification of enabled Defender’s security log collections, Wazuh monitoring of event channels, simulation of malware detection through the EICAR test file, and real-time alerts visualization and confirmation in the Wazuh dashboard for AD01. Setting this up was not bad at all I had to do was set up agents and connect or make sure that Sysmon via Sylog was connect to the endpoint (10.170.0.10) and that it was sending logs to the Wazuh Siem like I intended

Experiment 2
Simulate and investigate an attack using Atomic Red Team on Windows Defender logs. This simulation is necessary to determine if the system is protected and to verify that the appropriate logs are generated. The process involves installing the Atomic Red Team PowerShell module using the command (install-module -name invoke-atomic red team -scope current user) and importing the module with (import-module invoke-atomic red team). Next, available tests can be retrieved using (get-atomic technique -technique t1055) and a specific shellcode execution atomic test can be executed with (invoke-atomic test t1055.002 -test numbers 1). The chosen method involves shellcode execution via VBA, which is categorized as a T1055 process injection test. This particular method was selected because it often goes undetected due to its execution method. Shellcode execution via VBA embeds malicious machine code within a Microsoft Office VBA macro, executing it directly in the memory of the host process without writing to disk. This approach is typically employed to evade antivirus and sandbox detection since the payload operates in memory and is not stored as a separate file. Monitoring should occur in Wazuh logs to identify any processed injections. Key Event IDs to track include Sysmon Event ID 8 (CreateRemoteThread), Sysmon Event ID 10 (Process Access), and Sysmon Event ID 1 (Process Creation). If these indicators are not observed, it may be necessary to enhance Office security with ASR rules, log suspicious API calls with Sysmon/EDR, scan memory for shellcode patterns, analyze in a sandbox before opening unknown documents, and perform cleanup afterward. This method was selected due to its complexity as a type of malware. I had to turn off my real-time protection off in my setting to evening do this test.
I ran commands so I could see if my logs are going to Wazuh and they were indeed going to Wazuh and I clean up the test so no vulnerabilities wouldn't be in my system.

ran command Import-Module "C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1" -Force
so it could know what Invoke mean.
turned off real-time protection to see if wazuh would tell me about the test then i ran command

```$sess = New-PSSession -ComputerName 10.170.0.10 -Credential administrator
so it know what address to do test on
Ran command

Invoke-AtomicTest T1055.002 -TestNumber 1
Ran Command


Invoke-AtomicTest T1055.02 -TestNumber 1 -Cleanup
  - just so I can clean up what I did and no malware is on my system
it couldn't find the specified file so I just keep going on. But it did show up in my Wazuh Siem as malware Command and Control, Execution(T1105, T1059) and Sysmon event ids(1) was telling me that T1105 was PowerShell command/ Script execution, and T1059 was Download cradle.
A reference i use to get a better understand of this MITRE test is 

    
      
        
          atomicredteam.io
          

        
      
    




Experiment 3 

 Ran Command  

Import-Module "C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1" -Force

so it could know what Invoke mean.

turned off real-time protection to see if wazuh would tell me about the test then i ran command

$sess = New-PSSession -ComputerName 10.170.0.10 -Credential administrator
Ran Command

Invoke-AtomicTest T1547 -Testnumber 2
so i can see what wazuh sees about the test
then, Ran Command

Invoke-AtomicTest T1547 -TestNumber 2 -Cleanup
On the last two experiments I did forget to add an address to the environment to test so I had to re-do everything and they both did well. the last experiment was successful and shown on my Wazuh Siem as Lateral Movement (T1021.006) and event id 4769 showed a process creation(WinRM service process).
References that told me that this well always put a new driver in was
https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/pnputil-examples
https://www.atomicredteam.io/docs/atomics/T1547#atomic-test-2-driver-installation-using-pnputilexe

That's my project on how to update and secure harden antivirus and three experiments on the system AD01. I would like to thank Jean Fobe for giving advise on what I needed to work on in my proposal stage of my project, I like to Abygayle Iveyy for helping me better understand stand Jean Fobes advise and I would like to thank Yeldar Yestayev for approving my proposal I learned a lot from this project (New MITRE, Atomic red team, how to securely update a computer anti-virus). And I'm happy to have instructors like you guys.

DEV Community: Cameron Coleman-Willliams

Windows Logs (AD01) Securing the Environment and Testing Environment