Ox2A Security Blog

Zehra Begum — Tue, 29 Sep 2026 02:57:30 +0000

Testing Windows Defender and Wazuh with Atomic Red Team
Posted on September, 28 by Zehra Begum

Introduction

Building my first SIEM deployment hands-on cybersecurity journey with log aggregation, network visibility, and threat detection. I cover how I stood up and modified a baseline SIEM environment, encountered a few real-world misconfigurations along the way, and ran attack commands using Atomic Red Team (ART) to see how those activities surfaced in our logs.

Whoami

My name is a Zehra Begum, and i am field to specialize in network security and threat detection. This post represents my very first contribution to the cybersecurity community. I hope sharing my process, mistakes, and findings helps other aspiring analysts on a similar path.

Experiment time
Experiment #1 T1053.005:Scheduled Task
In the first experiment i tested the MITRE ATT&CK technique T1053.005 - Scheduled Task Running command Atomic tests on Ad01 verifies events trigger alert rules in Wazuh.
After running the command i checked wazuh's discover dashboard with the filter agent.name ad01 and see the modification was detected.

Experiment #2 T1027: Obfuscated Files or Information

Command run in "Invoke-AtomicTest T1027" in power shell to command technique used by attackers to hide malicious payload.

Experiment #3 T1078: Valid Account
Test SIEM detection abuse techniques using T1078 (Valid Accounts). This experiment verifies whether administrative or newly created account logons, account modifications trigger the expected detection rules and alerts in Wazuh.

Conclusion

Running these experiments highlighted the direct connection between endpoint configuration and SIEM visibility: without proper log verbosity, critical attack vectors remain invisible.

Final thoughts

Coolest Thing Learned:
Seeing raw adversary actions executed via Atomic Red Team instantly transform into structured alerts and structured log fields inside the SIEM dashboard.
Don't panic when logs don't show up immediately. Systematically isolate the path from event creation.

Refrences
Wazuh Documentation
Atomic RED Team Work Station
MITRE ATT&CK Technique Reference

DEV Community: Zehra Begum

Ox2A Security Blog