Active › Module 8 › Lesson 4
Lab — Detection
Detection literacy lab on $LAB_AD — event ID sheet, ATT&CK map, honeytoken plan, purple detection gap table.
Visual · t25_detection_lab
Lab: detection pack on YOUR $LAB_AD logs/scenarios. Original Cyberlium.
Opening
Prove blue can see what red names — in your lab SIEM table, not on a stranger domain's silence.
On YOUR $LAB_AD per brief: (1) finalize Event ID cheat sheet with alert hypotheses; (2) ATT&CK mapping table ≥5 techniques with detection gaps; (3) one honeytoken plan row deployed or simulated in lab with expected events; (4) purple detection exercise — authorized lab action (e.g., brief-assigned Kerberoast simulation on lab SPN) and document which Event IDs should fire — observe-only if brief forbids live red; (5) gap remediation recommendation per gap row; (6) integrity — $LAB_AD/synthetic only; (7) chmod 600 pack. No stranger log imports, no disabling SIEM on unauthorized systems, no attack cookbook attachments.
1. Detection pack
Event IDs + ATT&CK + honeytoken + gap table — cross-linked index.
Purple paragraph: what fired vs expected on lab exercise.
Command guide
Try these commands — Detection pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Detection lab — https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/ (audit policy literacy) MITRE detection — https://attack.mitre.org/ (map events to techniques) CISA SOC guidance — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
cat > "$LAB_AD/notes/detection-lab.txt" <<'EOF'
detection lab checklist (YOUR lab DC/workstation):
[ ] Enable Advanced Audit Policy on lab DC (test VM)
[ ] Collect 4769/4624/4662 samples from lab activity logs
[ ] Map each event to MITRE technique ID
[ ] No attack execution — study existing lab logs or doc sims
EOFCommand — copy this
grep '\[ \]' "$LAB_AD/notes/detection-lab.txt" curl -sS https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624 | head -6 curl -sS https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662 | head -6
Primary tools to practice this lesson: curl, grep. Reference sites: Detection lab (https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/); MITRE detection (https://attack.mitre.org/); CISA SOC guidance (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Simulated vs live
If brief allows live lab red on $LAB_AD — document UTC and revert snapshot.
If simulate-only — mark scenario rows clearly observed vs tabletop.
3. Integrity
No employer SIEM queries without authorization. Lab domain in all samples.
Detection output feeds Module 9 blue findings — not public exploit drop.
4. What you ship: detection lab pack
Event IDs + ATT&CK + honeytoken + purple gap table — chmod 600.
5. What you record before the next lesson
Detection lab pack path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Detection lab uses leaked enterprise SIEM export without authorization.
Right
Detection lab pack on $LAB_AD. Next: quiz.
Mission: detection lab
1) Event ID sheet finalized. 2) ATT&CK map with gaps. 3) Honeytoken row. 4) Purple exercise note; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Tabletop vs live purple — document how?”
Knowledge Check
APPLY: Detection lab includes:
Multiple choice
Knowledge Check
APPLY: True or False: Disable logging to test detection lab.
True or False
Knowledge Check
APPLY: Purple exercise documents:
Multiple choice