SANS FOR508 Home Lab Setup

 

I recently started preparing for SANS FOR508 (Advanced Incident Response, Threat Hunting, and Digital Forensics). One of the first things I wanted was a proper home lab where I could safely practice the labs, analyze artifacts, and get hands-on with DFIR tooling at will.

Below are the exact steps I used to build the lab environment at home using:

• VMware Workstation Pro
• SANS SIFT Workstation
• Windows 11
• Kali Linux

The setup is simple, isolated, and works well for practicing:

• Memory forensics
• Malware analysis
• PCAP analysis
• Windows event log investigations
• Threat hunting
• Incident response workflows

Everything runs isolated inside VMware Workstation Pro so you can safely practice investigations, packet analysis, memory forensics, log analysis, and incident response workflows.

I have a machine with 100 GB RAM, a 32-core CPU, and a 1 TB SSD. I’ll be using VMware Workstation Pro to build and run the lab environment on this system.

Recommended Hardware

Minimum workable setup:

• 32 GB RAM

• 4 CPU cores

• 500 GB SSD

Recommended if you can afford it:

• 64 GB RAM

• 8+ cores

• 1 TB SSD

Also make sure virtualization is enabled in BIOS:

• Intel VT-x

• AMD-V

Downloads

VMware Workstation Pro

VMware made Workstation Pro free for personal use.

Download here:

VMware Workstation Pro

---

SANS SIFT Workstation

Official SANS forensic VM.

Download:

SANS SIFT Workstation

OVA downloads:

SIFT Downloads

SIFT already includes tools like:

• Volatility

• Autopsy

• Sleuth Kit

• Plaso

• Rekall

Kali Linux VMware Image

Use the prebuilt VMware image instead of installing manually.

Download:

Kali VMware Images

Grab the VMware 64-bit image.

Windows 11 ISO

Official Microsoft ISO:

Windows 11 ISO

Step 1 — Install VMware Workstation Pro

Pretty straightforward:

1. Download installer

2. Run as Administrator

3. Next → Next → Finish

4. Reboot

Once installed, open VMware and make sure virtualization is detected properly.

Step 2: Create an Isolated Lab Network

This part matters.

Do NOT bridge these VMs directly to your home network if you're planning malware analysis or offensive testing.

Inside VMware:

Edit → Virtual Network Editor

Create:

VMnet2

Settings:

• Host-only

• DHCP disabled

• Subnet:

  • 192.168.50.0/24

You'll use this as the internal lab network.

Keep VMnet8 (NAT) enabled for internet access when needed.

Step 3: Import SIFT VM

Inside VMware:

File → Open

Select the SIFT OVA file.

Recommended specs:

Resource	Value
RAM	8–12 GB
CPU	4 vCPU
Disk	100 GB+

Network adapters:

Adapter	Network
Adapter 1	VMnet8 (NAT)
Adapter 2	VMnet2

Boot it up and update everything:

sudo apt update && sudo apt upgrade -y

Step 4: Import Kali Linux

Extract the Kali archive first.

Then open the .vmx file directly in VMware.

Recommended specs:

Resource	Value
RAM	6–8 GB
CPU	2–4 vCPU
Disk	80 GB+

Network:

Adapter	Network
Adapter 1	VMnet8
Adapter 2	VMnet2

Update Kali:

sudo apt update && sudo apt full-upgrade -y

Install a few useful tools:

sudo apt install -y \
wireshark \
docker.io \
bloodhound \
neo4j \
remmina

Step 5: Create Windows 11 VM

Create a new VM using the Windows 11 ISO.

Enable:

• UEFI

• TPM

Recommended specs:

Resource	Value
RAM	8–12 GB
CPU	4 vCPU
Disk	100 GB+

Important:

Only connect Windows to VMnet2 initially.

That keeps the victim machine isolated.

Step 6: Install Basic Windows Tooling

Inside Windows 11 install:

• VMware Tools

• Sysmon

• 7-Zip

• Windows Terminal

• Chrome or Firefox

Sysmon download:

Sysmon Download

Good Sysmon config:

SwiftOnSecurity Sysmon Config

Install Sysmon:

sysmon64.exe -accepteula -i sysmonconfig.xml

This gives you much better forensic logging.

Step 7: Assign Static IPs

Makes the lab easier to manage.

SIFT

192.168.50.10

Kali

192.168.50.20

Windows 11

192.168.50.30

No gateway needed for the isolated network.

Step 8: Take Snapshots

Do this early. You'll thank yourself later.

Good checkpoints:

• Fresh install

• Tools installed

• Clean baseline

• Before malware testing

Typical snapshot names:

CLEAN_INSTALL
DFIR_READY
MALWARE_TESTING

Step 9: Shared Folder Setup

Create a shared folder on the host:

C:\LabShare

Use it for:

• PCAPs

• Memory dumps

• Malware samples

• EVTX logs

• Disk images

Inside VMware:

VM Settings → Options → Shared Folders

Step 10: Lock Down the Lab

Inside VMware settings disable:

• Drag and drop

• Copy/paste

Go to:

VM Settings → Isolation

Uncheck both options.

Small thing, but worth doing.

Optional Additions

REMnux

Excellent Linux malware analysis VM.

Download:

REMnux

Flare VM

Windows malware analysis toolkit.

Download:

Flare VM