Active › Module 7 › Lesson 4
Lab — Defense
Defense hardening lab on $LAB_AD — tiering diagram, gMSA/SPN audit, LSA/Credential Guard status; no attack cookbooks.
Visual · t25_defense_lab
Lab: defense hardening pack on YOUR $LAB_AD. Original Cyberlium.
Opening
Ship the hardening checklist your blue team would deploy — not the attack chain that bypasses it on a stranger forest.
On YOUR $LAB_AD per brief: (1) tiering/PAW diagram with tier labels on all lab VMs; (2) SPN audit table — account, SPN present, gMSA recommendation; (3) LSA/Credential Guard status on admin and workstation lab VMs; (4) three prioritized hardening actions with owner column; (5) map each action to Module 6 path it mitigates (DCSync tier, ACL cleanup, delegation audit); (6) integrity — $LAB_AD only, no attack cookbook attachments; (7) chmod 600 pack. Optional: purple note — one detection that confirms hardening worked. Revert snapshot after if brief requires.
1. Deliverables
Tier diagram + SPN table + Guard status + prioritized fix list.
Cross-link Module 6 path rows — show defense closes path.
Command guide
Try these commands — Deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Defense lab — https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model (tiering checklist) CISA AD — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices Microsoft auditing — https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
python3 - <<'PY'
import os
lab = os.environ.get('LAB_AD', os.path.expanduser('~/cyberlium-lab/t25-ad'))
mitigations = [
'Tier 0/1/2 separation', 'PAW for admins', 'gMSA for service SPNs',
'Credential Guard on PAWs', 'Audit Kerberos 4769', 'Remove DONT_REQ_PREAUTH',
]
path = os.path.join(lab, 'notes', 'defense-mitigations.txt')
open(path, 'w').write('
'.join(f'- {m}' for m in mitigations))
print(f'Wrote {path} — apply in YOUR lab only')
PYCommand — copy this
grep -E 'Tier|PAW|gMSA|Credential' "$LAB_AD/notes/defense-mitigations.txt"
═══ WINDOWS ═══
YOUR lab-joined machine — verify tiering awareness only
Command — copy this
whoami /groups | findstr /i "Domain Admins Enterprise" Write-Output 'If you see DA on workstation — bad hygiene; document for lab report'
Primary tools to practice this lesson: python3, grep. Reference sites: Defense lab (https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model); CISA AD (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices); Microsoft auditing (https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Actionable fixes — not 'use stronger password' without account name on lab.
Honest N/A for VBS on nested VM — document limitation.
3. Integrity
Zero Kerberoast/PtH/DCSync exploit scripts in pack — hardening evidence only.
Lab domain names only — redact if exporting sample.
4. What you ship: defense lab pack
Tier + SPN + Guard + three fixes + integrity — chmod 600.
5. What you record before the next lesson
Defense lab pack path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Defense lab zip includes Mimikatz output from employer laptop.
Right
Defense lab pack on $LAB_AD. Next: quiz.
Mission: defense lab
1) Tier/PAW diagram. 2) SPN audit table. 3) Guard status rows. 4) Three fixes linked to Module 6; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Priority order — tier vs SPN vs Guard?”
Knowledge Check
APPLY: Defense lab includes:
Multiple choice
Knowledge Check
APPLY: True or False: Attack scripts required in defense lab.
True or False
Knowledge Check
APPLY: Hardening actions should link to:
Multiple choice