Active › Module 10 › Lesson 2
Lab Path
AD attacks literacy path on $LAB_AD — enum to paths to defense to detection to report with ethics gates.
Visual · t25_lab_path
Lab path = visual literacy chain on YOUR $LAB_AD. Original Cyberlium.
Opening
Draw the path from lab RoE to purple retest — with stop signs at every stranger-domain shortcut.
Document literacy path: $LAB_AD deploy → RoE → structure/enum literacy → auth abuse named → paths (DCSync/ACL/delegation) → defense hardening → Event IDs/ATT&CK/honeytoken → findings/remediation/purple → share-safe report. Ethics gates: stranger AD, attack cookbooks, cred dumps, log clearing, unauthorized SIEM — refused paths labeled red. UTC milestones and artifact IDs per station. Mermaid or sketch chmod 600. Honest N/A if brief skipped live purple — tabletop marked. Defender breakpoint: where tiering or detection shortened path to finding.
1. Path stations
RoE, enum, auth named, paths, defense, detection, report, purple retest — eight minimum.
Each station links evidence index row and module lesson ID.
Command guide
Try these commands — Path stations
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GOAD — https://github.com/Orange-Cyberdefense/GOAD (next AD lab path) TryHackMe AD — https://tryhackme.com/ (guided AD rooms) Hack The Box — https://www.hackthebox.com/ (AD boxes in-platform only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
cat > "$LAB_AD/notes/lab-path.txt" <<'EOF'
done: AD literacy, named techniques, defender mitigations, detection map
stay in scope: GOAD / HTB / THM assigned AD labs YOU joined
next: Topic 26 DFIR — carry evidence discipline forward
never: attack cookbooks on stranger domains
EOFCommand — copy this
grep -E 'done|next|never|stay' "$LAB_AD/notes/lab-path.txt" curl -sS https://github.com/Orange-Cyberdefense/GOAD | head -5
Primary tools to practice this lesson: curl, grep. Reference sites: GOAD (https://github.com/Orange-Cyberdefense/GOAD); TryHackMe AD (https://tryhackme.com/); Hack The Box (https://www.hackthebox.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Ethics overlay
Red stops at stranger domain, DCSync cookbook, Kerberoast on unauthorized AD, hash dump export.
Named literacy branch always available — attack branch refused.
3. Purple breakpoint
Mark where alert fired or gap documented after remediation.
One paragraph detection uplift from YOUR $LAB_AD path.
4. What you ship: lab path diagram
Literacy path with ethics gates + UTC milestones — chmod 600.
5. What you record before the next lesson
Lab path diagram path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Lab path includes stranger-domain takeover shortcut lane.
Right
Lab path documented for $LAB_AD. Next: Evidence Pack.
Mission: lab path diagram
1) Map eight stations. 2) Add five ethics gates. 3) UTC milestones per station. 4) Link evidence index IDs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Diagram vs numbered list for capstone?”
Knowledge Check
APPLY: Lab path documents:
Multiple choice
Knowledge Check
APPLY: True or False: DCSync cookbook shortcut on path OK.
True or False
Knowledge Check
APPLY: Path ends at:
Multiple choice