Home labs & practical projects
Develop a detection from a hypothesis and test cases
A project to do with your own tools, with guidance on what to create and capture.
What you could create
A defence team wants to detect unexpected scheduled-task creation in a lab dataset. The rule must distinguish an administrator’s planned change from suspicious behaviour.
| Evidence | What to capture |
|---|---|
| Detection specification and query | Show the inputs, scope and decisions behind this record. Each exclusion has an evidence-based purpose. |
| Test fixtures and analyst triage guide | Include the evidence supporting your conclusion. The test set includes at least one plausible false positive and one missed-case risk. |
What you'll need
Local lab
Author synthetic task-creation events with user, host, command description and change-window fields. Include benign and suspicious labelled examples.
Project record
Keep the working files for detection specification and query and record assumptions as you go.
Current reference material
Use the linked provider resources to verify the features, access terms and version relevant to your project.
Access & cost
Uses your own computer. Confirm hardware capacity, software licences and download terms before setup.
Use disposable VMs, containers or a simulator. Keep the lab separate from your everyday machine and work network.
Suggested milestones
- 1
Plan and investigate
Write the detection hypothesis and required telemetry fields.
- 2
Develop your approach
Implement a query with explicit exclusions and test it against the examples.
- 3
Verify and explain
Document bypass assumptions, triage context and the cost of each exclusion.
Useful resources
Use these resources to deepen your understanding and check key details.
Review the current provider requirements and relevant subject areas.
Check relevance, platform versions and current access terms.
Find relevant providers and check features, access requirements and costs.
A useful starting point
Author synthetic task-creation events with user, host, command description and change-window fields. Include benign and suspicious labelled examples.
What a good result looks like
- Each exclusion has an evidence-based purpose.
- The test set includes at least one plausible false positive and one missed-case risk.
Finish the project
Save sanitised evidence, then remove the lab instances or revert to the clean snapshot. Remove temporary accounts and credentials.
Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.