Evidence Pack
Bundle Topic 25 literacy evidence from $LAB_AD — paths, defense, detection, report; no attack cookbooks.
Visual · t25_evidence_pack
Evidence pack = mentor handoff from $LAB_AD literacy. Original Cyberlium.
One indexed pack beats scattered BloodHound screenshots — and never includes a stranger-domain DCSync script.
Assemble evidence pack: $LAB_AD RoE, paths lab rows, defense lab hardening, detection lab (Event IDs/ATT&CK/honeytoken), report lab findings/remediation/purple, integrity statement ($LAB_AD only, named-not-cookbook, no unauthorized cred dumps). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + diagrams, not live attack tool output. Gap paragraph for Topic 26 Digital Forensics (DFIR) — separate authorized track. Scan folder for Mimikatz, DCSync cookbooks, Kerberoast scripts against strangers — zero tolerance.
1. Pack contents
Minimum: RoE, paths, defense, detection, report, index, integrity.
Optional: purple loop diagram — no stranger attack logs.
Command guide
Try these commands — Pack contents
═══ WINDOWS / POWERSHELL (Active Directory Lab) ═══
Check current user, domain context, and security privileges
Command — copy this
whoami /user /groups /priv
Query active Domain Controller and trust relationships
Command — copy this
nltest /dsgetdc:$env:USERDOMAIN nltest /domain_trusts
List password policy across the domain
Command — copy this
net accounts /domain
Check Kerberos ticket cache
Command — copy this
klist
═══ LINUX / BASH (Lab Network) ═══ Test DNS SRV resolution for Active Directory services
Command — copy this
dig _ldap._tcp.dc._msdcs.lab.local SRV +short dig _kerberos._tcp.dc._msdcs.lab.local SRV +short
Primary tools to practice this lesson: grep, python3. Reference sites: Evidence pack (https://attack.mitre.org/); Microsoft audit (https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/); CISA AD (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Checklist row ↔ index row accountability.
3. Integrity
$LAB_AD only, named literacy, no attack cookbooks, share-safe export.
Scan before seal — remove accidental exploit drafts.
4. What you ship: AD literacy evidence pack
Bundled deliverables + index + integrity — chmod 600, report not cookbook default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Evidence pack includes DCSync script and stranger hash dump.
- Right: Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle paths defense detection report index. 2) Integrity statements. 3) Confirm zero cookbook files. 4) Gap note for Topic 26 DFIR.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
APPLY: Evidence pack includes:
APPLY: True or False: Attack cookbook in pack by default.
APPLY: Integrity line states: