Active › Module 10 › Lesson 4
Lab — Capstone
Execute capstone on $LAB_AD — checklist, lab path, evidence pack sealed; zero attack cookbooks.
Visual · t25_capstone_lab
Capstone: checklist × $LAB_AD literacy evidence. Original Cyberlium.
Opening
Close the AD literacy loop — paths named, defenses applied, detection mapped, report shipped — without a stranger-domain cookbook.
Walk Topic 25 checklist on YOUR $LAB_AD: verify RoE, lab path current, paths lab with defender fixes, defense lab hardening applied, detection lab with ATT&CK gaps, report lab with purple retest, evidence pack indexed, scan for attack cookbooks (must be zero). Update index with capstone UTC completion. Purple paragraph: tiering or detection key insight from YOUR path. No DCSync/Kerberoast/PtH cookbooks against strangers, no unauthorized SIEM, no hash dump attachments. Optional mentor review — three clarity questions. Revert $LAB_AD snapshot after if brief requires.
1. Execute checklist
Check each row; link artifact or N/A; confirm zero refused techniques in any file.
Scan sealed pack for Mimikatz/DCSync cookbook — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Capstone AD literacy — https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dmc/active-directory-domain-services MITRE ATT&CK — https://attack.mitre.org/matrices/enterprise/ Microsoft PAW/tiering — https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model BloodHound docs — https://bloodhound.readthedocs.io/ (graph literacy recap) CISA AD — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install nmap brew install python3
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t25-ad/lab.env" 2>/dev/null || export LAB_AD_HOST=${LAB_AD_HOST:-127.0.0.1}
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
grep never "$LAB_AD/roe.txt"capstone: port triage + doc fetch + report stub — YOUR lab DC only
Command — copy this
nmap -Pn -p 53,88,389,636,445,3389 "$LAB_AD_HOST" 2>/dev/null | tee "$LAB_AD/report/capstone-nmap.txt" | head -12
curl -sS https://attack.mitre.org/matrices/enterprise/ | head -5 | tee "$LAB_AD/report/capstone-mitre-snippet.txt"
python3 - <<'PY'
import os
lab = os.environ.get('LAB_AD', os.path.expanduser('~/cyberlium-lab/t25-ad'))
report = os.path.join(lab, 'report', 'capstone-summary.txt')
open(report, 'w').write('AD Attacks Literacy Capstone
scope: YOUR lab forest only
techniques: named T1558/T1550/T1003 — no cookbooks
defense: tiering/PAW/gMSA/Credential Guard
detection: 4769/4624/4662 mapping
')
print(f'Wrote {report}')
PYCommand — copy this
grep -E 'scope|techniques|defense|detection' "$LAB_AD/report/capstone-summary.txt" chmod 600 "$LAB_AD/report/"*.txt 2>/dev/null || true
═══ WINDOWS ═══
Capstone on YOUR lab-joined Windows VM only
Command — copy this
nltest /dsgetdc:lab.local whoami /groups | findstr /i "Domain" Get-Content $HOME/cyberlium-lab/t25-ad/roe.txt | Select-String never
Primary tools to practice this lesson: nmap, curl, grep, python3. Reference sites: Capstone AD literacy (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dmc/active-directory-domain-services); MITRE ATT&CK (https://attack.mitre.org/matrices/enterprise/); Microsoft PAW/tiering (https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model); BloodHound docs (https://bloodhound.readthedocs.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Purple paragraph
Detection or hardening key → defender uplift idea from YOUR lab path.
Name what breaks if you skip RoE or ship attack cookbook — integrity tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 26 Digital Forensics (DFIR) on separate authorized track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + purple paragraph + zero cookbook scan.
5. What you record before the next lesson
Capstone pack path. $LAB_AD quiet.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone includes DCSync output from unauthorized domain.
Right
Capstone complete on $LAB_AD with full teardown. Next: topic quiz.
Mission: Topic 25 capstone
1) Walk checklist with evidence links. 2) Purple paragraph from your path. 3) Seal pack — zero cookbook files. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Attack cookbook capstone deliverable earns credit.
True or False
Knowledge Check
APPLY: Capstone teardown includes:
Multiple choice