AeroLab is my home lab. Each writeup below runs a single MITRE ATT&CK technique against a live host, then works out how to catch it. Baseline the target, execute, detect it several different ways, compare what the endpoint tool sees against what the log pipeline recorded, write a rule, and return the host to its starting state.
The interesting part is usually where a detection method fails rather than where it works. Every writeup documents the gaps and the false positives alongside the results, because a rule you cannot tune is a rule nobody will keep running.
Hardware and network design are covered in the AeroLab v2 build writeup. Two Lenovo M920q nodes running Proxmox, a UniFi switch, segmented networks, and a full detection stack.
$ Detection stack: Velociraptor | Sysmon | Winlogbeat | Elastic SIEM | Sigma | Suricata
$ techniques
1
documented end to end
$ tactics
1
of 14 enterprise tactics
$ rules
1
sigma rules written
$ framework
MITRE ATT&CK
enterprise matrix
On scope. Everything here runs against hosts I built and own, on an isolated lab network. Techniques are executed with benign payloads that prove the mechanism without doing damage, and every host is returned to a verified baseline afterward. Detection rules are published as written and tested, including the conditions where they would fire on ordinary activity.