Lakshan Sameera

Undergraduate

🌐 Azure Sentinel (SIEM) Lab: Real-Time RDP Attack Detection with PowerShell

Category: Blue Team | SIEM | Threat Monitoring | Automation
Timeline: May 2024
Tools Used: Azure Sentinel, PowerShell, ipgeolocation.io, Windows Event Viewer, Visual Studio Code, GitHub
🔗 Project Article

This project presents a cloud-native Security Information and Event Management (SIEM) lab built on Microsoft Azure Sentinel, designed to detect and analyze failed RDP login attempts in real time. By leveraging a custom PowerShell script, telemetry from a honeypot virtual machine is processed, enriched with attacker geolocation data using the ipgeolocation.io API, and visualized through Azure Sentinel’s advanced dashboards.

🎯 Objective & Scope:

Detect failed Remote Desktop Protocol (RDP) login attempts via Windows Event Logs.
Automate log parsing and enrichment using PowerShell and third-party APIs.
Feed data into Azure Sentinel for real-time security visibility and threat correlation.
Visualize geographic trends of brute-force attack origins, enhancing situational awareness and incident response planning.

🧪 Architecture & Workflow:

1. Honeypot Setup & Data Collection

A Windows-based honeypot VM was configured to simulate a vulnerable endpoint and attract RDP brute-force attempts.
Event ID 4625 (failed login) was continuously collected from Windows Event Viewer, serving as the primary data source for the SIEM integration.

2. PowerShell Automation

Developed a PowerShell script to:
- Parse Windows Security Event Logs
- Extract failed RDP login attempts, source IPs, and timestamps
- Query the ipgeolocation.io API to retrieve geolocation data (country, region, coordinates)
- Format and forward this enriched telemetry to Azure Sentinel

3. SIEM Integration – Azure Sentinel

Configured Log Analytics Workspace in Azure and connected it to the honeypot VM.
Telemetry from the script was sent to Azure Sentinel using custom log ingestion pipelines.
Built interactive dashboards and maps to:
- Visualize attacker IP geolocation
- Track attack frequency over time
- Spot abnormal patterns such as IP clusters or regional anomalies

4. Demonstration Results

RDP brute-force attempts from Pakistan and Sri Lanka were detected within hours.
Custom dashboards showed real-time global attack maps, IP clustering, and repeated access patterns.
Self-generated traffic (controlled test attacks) validated detection accuracy and visualization effectiveness.

📌 Technologies & Utilities Used:

PowerShell – Core scripting logic to parse logs, automate API requests, and structure event data
Azure Sentinel – SIEM platform for centralized monitoring, query analysis (KQL), and threat detection
ipgeolocation.io – IP-to-geolocation enrichment service for external attacker attribution
Visual Studio Code – Script development and debugging
GitHub – Project repository hosting, collaboration, and documentation

🔗 GitHub Repo: Azure Sentinel RDP Detection Lab

🧠 Key Skills Demonstrated:

SIEM configuration & log integration using Microsoft Azure
PowerShell scripting for log automation and API integration
Real-time threat monitoring using custom event correlation
Data enrichment & visualization for actionable threat intelligence
Building scalable and reusable detection logic for enterprise defense

💡 Future Enhancements:

Enable real-time alerting for suspicious login patterns using Azure Sentinel Playbooks.
Integrate with additional threat intelligence feeds (AbuseIPDB, AlienVault OTX) for context-aware detection.
Automate incident response workflows using Logic Apps and Azure Functions.
Enhance dashboard interactivity using Power BI embedded insights within Sentinel.

✅ Outcome & Impact:

This project showcased the ability to build a fully functional SIEM detection lab from scratch, combining PowerShell automation, telemetry integration, and cloud-based threat visibility. It reinforced practical capabilities in log analysis, event correlation, security automation, and Blue Team defense architecture, making it a powerful portfolio piece for SOC roles, cloud security, and SIEM engineering.

Showcase Your Work, Get Noticed!

Your projects deserve the spotlight! Share your best work, inspire others, and open doors to new opportunities. Whether you're a student or a pro, this is your stage to shine.

Get visibility from recruiters & peers
Build your portfolio & personal brand
Connect with like-minded developers

Let's put your work in front of the right people!

Similar Projects

Cyber Security

NmapOpenVASMetasploit FrameworkWHOISKali LinuxMeterpreter

Penetration Testing Simulation for Securing Organizational Systems (Penetration Testing - Ethical Hacking)

Penetration Testing Simulation for Securing Organizational Systems Conducted an in-depth penetration test and vulnerability assessment on a simulated...

View Project

Cyber Security

WiresharkSnortVirusTotalubuntulinux

Security Operations - Network Intrusion Analysis and Detection for DevonCinema (Security Operations and Network Intrusion Analysis)

Security Operations & Network Intrusion Analysis for DevonCinema Category : Blue Team | Network Forensics | Intrusion Detection Timeline : January 2...

View Project

Cyber Security

FTK ImagerAutopsyVolatilityKernel PST ViewerWiresharkMXToolboxvirusTotallinuxWindows

Comprehensive Digital Forensics Report for Cybersecurity Incident Response (Digital Forensics)

🧩 Digital Forensic Investigation into Unauthorized Data Exfiltration at ABC Company Coursework : PUSL3133 – Digital Forensics & Malware Analysis ...

View Project

Cyber Security

OSSEC HIDSMetasploitKali LinuxWindows 7 SP1UbuntuOSSEC Web UIEternalBlueeventViewer

🛡️🔓 OSSEC HIDS: Detecting the EternalBlue (MS17-010) Exploitation (Security Operations - OSSEC HIDS (Host Based Intrusion Detection System) )

🛡️🔓 OSSEC HIDS: Detecting the EternalBlue (MS17-010) Exploitation Category : Blue Team & Red Team | Host-Based Intrusion Detection | Exploit Simula...

View Project

Cyber Security

PythonPowerShellC#socketOpenCVPyAutoGUIrequeststhreadingip-apiWiresharkVMwareWindows 10Kali LinuxVisual StudioGitHub

🧠 Reverse Shell – Remote Administration Tool (RAT) (Hacking Tool - Offensive Security )

🧠 Reverse Shell – Remote Administration Tool (RAT) Category : Red Team | Remote Access | Malware Simulation | Ethical Hacking Timeline : June 2024...

View Project

Cyber Security

C#.NET Framework 4.5+Visual StudioWindows APISystem.Net.MailIP Geolocation APIGitHubWindows OSmacintoshpyautoguisocket``threading``cv2``numpy`

🧠 Key Logger with Email Notifications: A Comprehensive Cybersecurity Monitoring Tool (KeyLogger - Offensive Security Tool )

🧠 Key Logger with Email Notifications: A Comprehensive Cybersecurity Monitoring Tool Category : Red Team | Offensive Security | Malware Simulation ...

View Project