Active › Module 9 › Lesson 1
Findings for Blue
Write AD findings for blue team from $LAB_AD — structured rows, observed vs inferred, ATT&CK and Event ID links, no attack cookbooks.
Visual · t25_findings_for_blue
Findings for blue = defender-ready report rows. $LAB_AD sourced. Original Cyberlium.
Opening
Blue needs a finding they can ticket — not a stranger-domain attack montage with Mimikatz screenshots.
AD finding structure for blue: title, affected object ($LAB_AD domain/OU/account), misconfiguration class (ACL path, weak SPN, tier violation, missing Guard), observed evidence (log excerpt, graph edge name, config read — from authorized lab), ATT&CK technique ID, recommended detection (Event ID + alert name from Module 8), severity in lab context. Observed vs inferred labels mandatory. Cyberlium findings from $LAB_AD and authorized purple exercises — NOT findings from unauthorized prod AD tests, NOT attach full Kerberoast/DCSync command transcripts against strangers, NOT publish live cred dumps as severity proof. chmod 600 under $HOME/cyberlium-lab/reports. Feeds capstone evidence pack.
1. Finding row template
Summary, asset, misconfig class, evidence, ATT&CK, detection, severity, owner recommendation.
Blue-readable: ticket title suggestion in summary line.
Command guide
Try these commands — Finding row template
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Findings for blue — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices (actionable recs) MITRE ATT&CK — https://attack.mitre.org/ (technique IDs in findings) Microsoft security operations — https://learn.microsoft.com/en-us/security/operations/ (SOC handoff literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
mkdir -p "$LAB_AD/notes"
cat > "$LAB_AD/notes/finding-blue-template.txt" <<'EOF'
finding: Kerberoastable SPN on user account (lab)
severity: High (lab context)
technique: T1558.003
evidence: Event 4769 pattern / BloodHound edge (lab graph)
recommendation: migrate to gMSA, rotate password, monitor 4769
scope: YOUR lab forest only — never stranger domains
EOFCommand — copy this
grep -E 'finding|technique|scope' "$LAB_AD/notes/finding-blue-template.txt"
python3 -c "print('Blue finding template ready — literacy only, no attack cookbook')"Primary tools to practice this lesson: python3, grep. Reference sites: Findings for blue (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices); MITRE ATT&CK (https://attack.mitre.org/); Microsoft security operations (https://learn.microsoft.com/en-us/security/operations/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence hygiene
Redact paths; lab domain only; graph edge names OK — stranger hostnames refused.
Log lines synthetic or $LAB_AD — label source.
3. Scope integrity
$LAB_AD RoE block in every report pack.
Refused: dramatized DA takeover video from unauthorized AD.
4. What you ship: blue finding template
Finding row fields + observed/inferred rule + sample row from lab.
5. What you record before the next lesson
Blue finding template path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Finding includes DCSync output from employer DC as evidence.
Right
Blue finding template from $LAB_AD work. Next: Remediation Recs.
Mission: blue finding template
1) List finding row fields. 2) Write observed vs inferred rule. 3) Draft one finding from paths lab. 4) Link Event ID detection.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Severity without exploit demo?”
Knowledge Check
APPLY: Blue finding includes:
Multiple choice
Knowledge Check
APPLY: True or False: Unauthorized AD test findings belong in report.
True or False
Knowledge Check
APPLY: Finding evidence should:
Multiple choice