Finished
Wargame: attack and defense with a DMZ
Attack-and-defense wargames for a cybersecurity projects course (2026). Each team set up and hardened its own machines, and in class we attacked each other; after a while we could also defend our own in real time while attacking the rest.
What I did and how it works
- Several wargame sessions spread over months, with three scenarios: a Linux machine, a Windows machine and an Active Directory environment with a DMZ (Windows or Linux).
- Teams of four in which we all worked across every area. I specialised in machine configuration, designing the attack vectors and attacking other teams’ machines.
- Executed Active Directory attack chains: enumeration, lateral movement and privilege escalation.
- Deployed and operated Wazuh SIEM for log correlation and threat detection.
Results
- Around 75 % of the rival machines compromised (approximate figure; the available time limited how many we could attack).
- 100 % traceability of what other teams did against our machines, thanks to monitoring and logging with Wazuh SIEM.