Lab — Defense

Defense hardening lab on $LAB_AD — tiering diagram, gMSA/SPN audit, LSA/Credential Guard status; no attack cookbooks.

Lab — Defense• Audio Walkthrough

00:00/02:58

Visual · t25_defense_lab

Lab: defense hardening pack on YOUR $LAB_AD. Original Cyberlium.

Ship the hardening checklist your blue team would deploy — not the attack chain that bypasses it on a stranger forest.

On YOUR $LAB_AD per brief: (1) tiering/PAW diagram with tier labels on all lab VMs; (2) SPN audit table — account, SPN present, gMSA recommendation; (3) LSA/Credential Guard status on admin and workstation lab VMs; (4) three prioritized hardening actions with owner column; (5) map each action to Module 6 path it mitigates (DCSync tier, ACL cleanup, delegation audit); (6) integrity — $LAB_AD only, no attack cookbook attachments; (7) chmod 600 pack. Optional: purple note — one detection that confirms hardening worked. Revert snapshot after if brief requires.

1. Deliverables

Tier diagram + SPN table + Guard status + prioritized fix list.

Cross-link Module 6 path rows — show defense closes path.

Command guide

Try these commands — Deliverables

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Defense lab — https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model (tiering checklist) CISA AD — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices Microsoft auditing — https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
python3 - <<'PY'
import os
lab = os.environ.get('LAB_AD', os.path.expanduser('~/cyberlium-lab/t25-ad'))
mitigations = [
  'Tier 0/1/2 separation', 'PAW for admins', 'gMSA for service SPNs',
  'Credential Guard on PAWs', 'Audit Kerberos 4769', 'Remove DONT_REQ_PREAUTH',
]
path = os.path.join(lab, 'notes', 'defense-mitigations.txt')
open(path, 'w').write('
'.join(f'- {m}' for m in mitigations))
print(f'Wrote {path} — apply in YOUR lab only')
PY

Command — copy this

grep -E 'Tier|PAW|gMSA|Credential' "$LAB_AD/notes/defense-mitigations.txt"

═══ WINDOWS ═══

YOUR lab-joined machine — verify tiering awareness only

Command — copy this

whoami /groups | findstr /i "Domain Admins Enterprise"
Write-Output 'If you see DA on workstation — bad hygiene; document for lab report'

Primary tools to practice this lesson: python3, grep. Reference sites: Defense lab (https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model); CISA AD (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices); Microsoft auditing (https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.