I have built a vulnerable Active Directory lab at home with defensive telemetry, and documented it step by step in a separate guide. Here I explain what it is, why I built it and where each part lives.
What it is
Everything runs on a single Proxmox server (an i5-9600K with 32 GB of RAM):
- Ludus orchestrates the VMs, the network and the VPN
- GOAD-Light provides the vulnerable Active Directory: two domains and three Windows Server 2019 hosts
- Elastic Security collects the events, with Elastic Agent and Sysmon on every Windows host
- WireGuard gives me access from my machine without exposing anything to the Internet
Why
Practising AD attacks is only half the job. The other half is knowing what each action leaves behind and what the defenders see. With Elastic in the same lab, everything I try I can then check in Kibana: which events it generated, which rules fired and which did not.
The guide