dfir-attack-lab

About the Project

DFIR Attack Lab is a meticulously designed simulation environment that recreates real-world cyberattack scenarios for training cybersecurity professionals in Digital Forensics and Incident Response. DFIR is the discipline of investigating security incidents after they occur — identifying what happened, how the attacker gained access, what data was compromised, and what steps are needed to recover and prevent recurrence. The laboratory provides a collection of pre-built attack scenarios that mirror actual incidents observed in enterprise environments. Each scenario includes a complete attack chain — from initial access (phishing email, exploited vulnerability, compromised credentials) through privilege escalation, lateral movement, data exfiltration, and persistence mechanisms. For every scenario, the lab generates realistic forensic artifacts: Windows Event Logs, Syslog entries, network packet captures (PCAP files), memory dumps, file system timeline data, and registry hive modifications. Investigators can practice the entire DFIR lifecycle: evidence preservation and chain of custody, disk and memory forensics using tools like Volatility and Autopsy, timeline analysis to reconstruct the sequence of events, indicator of compromise (IOC) extraction, malware triage and sandboxing, and comprehensive report writing. The lab runs entirely in Docker containers, ensuring consistent environments across different machines and operating systems. Each scenario includes a detailed 'answer key' that walks through the expected investigation process, making it ideal for both self-study and instructor-led training programs.

Why This Matters

The demand for skilled DFIR professionals far exceeds supply, creating a critical skills gap in cybersecurity. Training in digital forensics requires access to controlled environments with realistic artifacts — something that is difficult and expensive to create from scratch. Production environments cannot be used for training due to privacy concerns, legal restrictions, and the risk of interfering with actual business operations. Traditional DFIR training courses cost thousands of dollars and are often only available at specific times and locations. This lab democratizes DFIR education by providing a free, open-source platform that anyone can use to develop their forensic investigation skills. It is particularly valuable for SOC analysts looking to advance into incident response roles, university cybersecurity programs needing practical lab exercises, and organizations building internal DFIR capabilities. Each scenario is mapped to the MITRE ATT&CK framework, ensuring that practitioners learn to identify and document attack techniques using the industry-standard taxonomy, which is essential for threat intelligence sharing and improving organizational defenses.

Step-by-Step Guide

1. Start the lab environment by running 'docker-compose up -d' from the project root directory. This will launch all required containers including victim machines, attacker infrastructure, logging servers, and the forensic analysis workstation. The initial setup takes approximately 5-10 minutes.
2. Browse the /scenarios directory and select a training scenario. Each scenario has a README.md describing the simulated attack, learning objectives, difficulty level (beginner/intermediate/advanced), and estimated completion time. Start with 'scenario-01-phishing-compromise' if you are new to DFIR.
3. Execute the attack simulation using the provided scripts, which will generate all forensic artifacts automatically. Alternatively, use the pre-generated artifact packs if you want to skip directly to the investigation phase. All artifacts are placed in the /evidence directory for each scenario.
4. Conduct your forensic investigation using the analysis tools included in the lab (Volatility, Autopsy, Wireshark, YARA). Document your findings using the included report template. Compare your results against the scenario's answer key in /solutions to evaluate your analysis and identify areas for improvement.

Technologies Used