Active › Module 10 › Lesson 1
Checklist
Topic 25 capstone checklist — AD literacy, paths named, defense, detection, reporting on $LAB_AD.
Visual · t25_capstone_checklist
Checklist consolidates AD attacks literacy pillars. $LAB_AD only. Original Cyberlium.
Opening
Capstone proves AD defender literacy on YOUR lab forest — not a portfolio of stranger-domain takeover recipes.
Assemble checklist covering Modules 1–9: AD mindset and $LAB_AD RoE, structure/Kerberos/enum literacy, auth abuse named, privilege paths (DCSync/ACL/delegation), defense hardening (tier/PAW/gMSA/Guard), detection (Event IDs/ATT&CK/honeytoken), reporting and purple loop. Use on capstone walk of YOUR $LAB_AD — never stranger-domain cookbooks, live cred dumps, or unauthorized SIEM exports. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab. Integrity rows: $LAB_AD only, named-not-cookbook, remediation verified, purple loop documented.
1. Scope and ethics
$LAB_AD named with RoE reference. NEVER stranger domain, NEVER attack cookbook export, NEVER unauthorized hash dumps.
Named techniques row: DCSync ACL delegation Kerberoast PtH — literacy + defense only.
Command guide
Try these commands — Scope and ethics
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Capstone checklist — https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model MITRE ATT&CK — https://attack.mitre.org/ (technique literacy recap) CISA AD — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices BloodHound docs — https://bloodhound.readthedocs.io/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
cat > "$LAB_AD/notes/capstone-checklist.txt" <<'EOF'
[ ] RoE + lab.env with LAB_AD_HOST set
[ ] nmap AD ports on YOUR lab DC only
[ ] Kerberos/SPN/ticket literacy notes
[ ] Named techniques (T1558/T1550/T1003) — no attack cookbooks
[ ] Tiering/PAW/gMSA mitigation notes
[ ] Event ID detection map
[ ] Blue-team finding + remediation draft
[ ] never: stranger domains / Impacket / Mimikatz / Rubeus roast
EOFCommand — copy this
grep '\[ \]' "$LAB_AD/notes/capstone-checklist.txt"
python3 -c "print('Capstone: AD literacy + defense — lab scope only')"Primary tools to practice this lesson: grep, python3. Reference sites: Capstone checklist (https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model); MITRE ATT&CK (https://attack.mitre.org/); CISA AD (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices); BloodHound docs (https://bloodhound.readthedocs.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
Structure, Kerberos, enum, auth abuse, paths, defense, detection, report — linked rows.
Cross-link Topic 24 memory literacy if same VM host — checksec only.
3. Teardown
Notes secured chmod 600, report pack ready, $LAB_AD snapshot revert optional per brief.
Purple paragraph: detection uplift summary for blue handoff.
4. What you ship: Topic 25 capstone checklist
One-page AD literacy capstone checklist for $LAB_AD.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Checklist includes row 'DCSync stranger domain for bonus.'
Right
Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and purple paragraph section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger-domain cookbook required for capstone.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice