Nmap Network Service Scanning Detection

Overview

This lab demonstrates the detection and monitoring of network service scanning activity against a Windows 11 endpoint using Wazuh as the Security Information and Event Management (SIEM) platform.

The objective of this exercise was to simulate network reconnaissance using Nmap, generate Windows network connection telemetry through Sysmon Event ID 3, and verify that the resulting activity could be observed from the Windows endpoint and investigated through Wazuh.

The attack simulation was performed from a Kali Linux attacker machine against a Windows 11 victim machine within a controlled home lab environment.

Lab Environment

Machine	Role	IP Address
Kali Linux	Attacker Machine	192.168.109.128
Windows 11	Victim Endpoint	192.168.109.133
Ubuntu Server	SIEM / Wazuh Manager	192.168.109.130

Tools Used

Kali Linux
Nmap
Windows 11
Windows Event Viewer
Sysmon 15.21
Wazuh SIEM
MITRE ATT&CK

Objective

The objective of this test was to: