Cybersecurity Student Tests Wazuh SIEM Using Atomic Red Team Attack Simulations

Zehra Begum, a network security and threat detection student, documented her first hands-on SIEM deployment using Wazuh and Atomic Red Team (ART) to simulate real-world cyberattacks. She configured log-shipping agents and system files to capture host and network telemetry, then ran tests against three MITRE ATT&CK techniques: scheduled task persistence (T1053.005), file obfuscation via registry modification (T1027), and valid account abuse (T1078). The experiments demonstrated how endpoint misconfigurations can leave critical attack activity invisible in SIEM dashboards. Key takeaways included the importance of validating configuration syntax, enabling host-level auditing policies like Sysmon, and systematically tracing the log pipeline from event creation through to SIEM ingestion.