Building a Cloud-Native SOC

Building a Cloud-Native SOC: Detecting Brute Force & Obfuscated Attacks in GCP

In the modern threat landscape, visibility is the only difference between a minor incident and a catastrophic breach. For security professionals, especially those in DFIR and Cyber GRC, understanding the telemetry "pipeline"—from the moment a packet hits a firewall to the moment a SIEM flags a high-severity alert—is a non-negotiable skill.

I recently spent time architecting a fully functional, distributed Security Operations Center (SOC) within Google Cloud Platform (GCP). This wasn't just a setup exercise; it was a stress test of detection logic against 64,000+ real-world attack events.

🏗️ The Architecture: 3-Node Cloud Defense

The lab consists of three distinct zones within a custom GCP VPC:

The Brain (Wazuh Manager): A centralized SIEM/XDR platform hosted on Ubuntu 24.04. It handles log ingestion, decoding, and alert generation.

The Target (Windows Victim): A Windows Server 2025 instance. Crucially, I integrated Sysmon (with SwiftOnSecurity’s configuration) to provide high-fidelity telemetry that standard Windows Event Logs often miss.

The Adversary (Kali Linux): A cloud-native offensive node used to simulate reconnaissance, brute forcing, and "Living off the Land" (LotL) techniques.

🧪 Validating the Controls (The "Attack" Phase)

To prove the lab worked, I executed several specific adversary tactics mapped to the MITRE ATT&CK framework.

1. Brute Force (T1110)

Using hydra, I launched a massive password spray against the Windows RDP port.

The Data: Over 64,000 security events were processed in under an hour.

The Detection: Wazuh successfully correlated individual logon failures (Rule 60122) into a Level 10 "Multiple Logon Failures" alert (Rule 60204).

1. PowerShell Obfuscation (T1059.001)

I executed a Base64 encoded PowerShell command designed to simulate a malicious download.

The Detection: Thanks to Sysmon Event ID 1, the SIEM captured the entire command line, allowing me to see the intent behind the obfuscation.

1. File Integrity Monitoring (FIM)

I configured Wazuh to monitor a "Confidential" directory. When I manually modified a sensitive file (payroll.txt), the SIEM immediately flagged the checksum change, providing a forensic trail of the SHA256 hash before and after the modification.

🛡️ The GRC & DFIR Takeaways

As a GRC professional, building this lab highlighted a critical gap: The default configuration is the greatest risk. The Windows instance allowed 60,000+ failed logins without locking the account. By identifying this "control failure" through testing, I was able to implement a NIST-compliant Account Lockout Policy and verify its effectiveness by re-running the attack.

Technical Skills Applied:

Cloud Infrastructure Engineering (GCP VPC/Firewalls)

SIEM Management & Log Decoding

Adversary Emulation (Nmap, Hydra, Mimikatz)

Policy Remediation & Control Validation

🏁 Conclusion

Building a SOC in the cloud is more than just installing software; it’s about engineering visibility. If you aren't testing your detections with real attacks, you don't have a defense—you have a wish list.

Check out the full technical documentation on my GitHub: github.com/purvanshbhat