Active › Module 1 › Lesson 4
Lab — RoE
Pack AD mindset — scope, lab inventory, stranger refusal — Rules of Engagement file only, dest $LAB_AD.
Visual · t25_roe_lab
Lab: write RoE pack. $LAB_AD only. Original Cyberlium.
Opening
RoE pack before any LDAP bind — paperwork discipline AD mentors expect.
Lessons 1–3 defined why AD matters, lab AD hygiene, and stranger-domain refusal. This lab ships the combined artifact: literacy definition, lab AD inventory, and NEVER STRANGER DOMAIN block for $LAB_AD. No attack execution required — scope and RoE paperwork first. Next: Quiz — AD Mindset and Lab.
1. Lab contract: write the RoE pack
Create $HOME/cyberlium-lab/t25-m01-l04-roe-lab.txt with date, operator, $LAB_AD forest name, literacy vs cookbook paragraph, lab AD inventory, and NEVER STRANGER DOMAIN lines.
Optional: one-line proof your lab AD VM exists — still no unauthorized enum required in this lab.
Command guide
Try these commands — Lab contract: write the RoE pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
RoE literacy — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices (scope discipline) Microsoft security auditing — https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/ (defender logging mindset) MITRE ATT&CK — https://attack.mitre.org/ (technique IDs in RoE notes)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
cat > "$LAB_AD/roe.txt" <<'EOF'
LAB_AD=$HOME/cyberlium-lab/t25-ad
LAB_AD_HOST=127.0.0.1 # set to YOUR lab DC IP
targets: YOUR intentional AD lab only
never: stranger domains, production forests, attack cookbooks
allowed: nmap/dig on LAB_AD_HOST, curl docs, python3 mitigation notes
EOFCommand — copy this
chmod 600 "$LAB_AD/roe.txt" grep -E 'LAB_AD|never|allowed|targets' "$LAB_AD/roe.txt" curl -sS https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices | head -5
═══ WINDOWS ═══
Run on YOUR lab-joined Windows VM only — never production
Command — copy this
Get-Content $HOME/cyberlium-lab/t25-ad/roe.txt | Select-String never Write-Output 'Set LAB_AD_HOST to YOUR lab DC IP before nmap/dig exercises'
Primary tools to practice this lesson: grep, curl. Reference sites: RoE literacy (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices); Microsoft security auditing (https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check against misuse patterns
Grep notes for Rubeus one-liners, secretsdump, production FQDNs, or 'roast all' headings — redact or delete. Rewrite forum habits to $LAB_AD placeholders before you copy workflows.
Classmates build their own RoE packs for their $LAB_AD — not yours.
3. Lock the proof
chmod 600 on the pack. Quiz is next — then AD Structure Literacy.
AD mentors archive RoE before first enum; you are practicing that habit early.
4. What you ship: AD RoE pack for $LAB_AD
RoE pack: scope, lab inventory, refusal block. $LAB_AD named. NEVER stranger domains. chmod 600.
5. What you record before the next lesson
Date. RoE pack path. $LAB_AD scope note. File t25-m01-l04-roe-lab.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip the file and run enum against production. Add employer DC to approved list.
Right
Write YOUR RoE pack for $LAB_AD. chmod 600. Next: Quiz — AD Mindset and Lab.
Mission: freeze YOUR RoE pack on disk
1) Merge scope, inventory, refusal sections. 2) Name $LAB_AD. 3) chmod 600. Never list stranger-domain attacks as approved practice.
Stuck? Ask Cyberlium AI Mentor
RoE packs are boring on purpose — boring keeps you ethical.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: You should chmod 600 on AD lab notes.
True or False
Knowledge Check
APPLY: A tutorial runs Impacket against a live tenant. You:
Multiple choice