Active › Module 10 › Lesson 3
Evidence Pack
Bundle Topic 25 literacy evidence from $LAB_AD — paths, defense, detection, report; no attack cookbooks.
Visual · t25_evidence_pack
Evidence pack = mentor handoff from $LAB_AD literacy. Original Cyberlium.
Opening
One indexed pack beats scattered BloodHound screenshots — and never includes a stranger-domain DCSync script.
Assemble evidence pack: $LAB_AD RoE, paths lab rows, defense lab hardening, detection lab (Event IDs/ATT&CK/honeytoken), report lab findings/remediation/purple, integrity statement ($LAB_AD only, named-not-cookbook, no unauthorized cred dumps). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + diagrams, not live attack tool output. Gap paragraph for Topic 26 Digital Forensics (DFIR) — separate authorized track. Scan folder for Mimikatz, DCSync cookbooks, Kerberoast scripts against strangers — zero tolerance.
1. Pack contents
Minimum: RoE, paths, defense, detection, report, index, integrity.
Optional: purple loop diagram — no stranger attack logs.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Evidence pack — https://attack.mitre.org/ (technique IDs in appendix) Microsoft audit — https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/ CISA AD — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
mkdir -p "$LAB_AD/evidence"
python3 - <<'PY'
import os, shutil, glob
lab = os.environ.get('LAB_AD', os.path.expanduser('~/cyberlium-lab/t25-ad'))
evidence = os.path.join(lab, 'evidence')
manifest = ['roe.txt', 'notes/event-ids.txt', 'notes/remediation-recs.txt', 'notes/capstone-checklist.txt']
lines = []
for m in manifest:
src = os.path.join(lab, m)
if os.path.isfile(src):
dst = os.path.join(evidence, os.path.basename(m))
shutil.copy2(src, dst)
lines.append(f'copied: {m}')
open(os.path.join(evidence, 'manifest.txt'), 'w').write('
'.join(lines) or 'run prior modules first')
print('Evidence pack staged in evidence/ — lab only')
PYCommand — copy this
grep -E 'copied|run prior' "$LAB_AD/evidence/manifest.txt" 2>/dev/null | head -8 wc -l "$LAB_AD/evidence/"* 2>/dev/null | tail -3
Primary tools to practice this lesson: grep, python3. Reference sites: Evidence pack (https://attack.mitre.org/); Microsoft audit (https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/); CISA AD (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Checklist row ↔ index row accountability.
3. Integrity
$LAB_AD only, named literacy, no attack cookbooks, share-safe export.
Scan before seal — remove accidental exploit drafts.
4. What you ship: AD literacy evidence pack
Bundled deliverables + index + integrity — chmod 600, report not cookbook default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Evidence pack includes DCSync script and stranger hash dump.
Right
Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle paths defense detection report index. 2) Integrity statements. 3) Confirm zero cookbook files. 4) Gap note for Topic 26 DFIR.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Attack cookbook in pack by default.
True or False
Knowledge Check
APPLY: Integrity line states:
Multiple choice