Active › Module 9 › Lesson 4
Lab — Report
Assemble AD defender report from $LAB_AD — findings, remediation proof, purple loop; no attack cookbooks.
Visual · t25_report_lab
Lab: full AD report pack from $LAB_AD. Original Cyberlium.
Opening
Ship a report blue can merge — findings, fixes verified, purple loop closed, zero stranger-domain recipes.
From Modules 6–9 $LAB_AD work: (1) ≥2 blue finding rows with ATT&CK and Event IDs; (2) remediation section with before/after proof from defense lab; (3) purple loop diagram with retest result; (4) integrity block — $LAB_AD only, no attack cookbook attachments; (5) executive summary for mentor — three sentences max; (6) chmod 600 report pack with index. Scan for Mimikatz scripts, DCSync cookbooks, Kerberoast tool output against strangers — must be zero. Gap paragraph for capstone checklist. Optional: detection rule stub names from Module 8 — not full Sigma export unless brief assigns.
1. Pack contents
Findings, remediation proof, purple loop, integrity, index.md.
Cross-link paths lab and detection lab artifact IDs.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Report lab — https://attack.mitre.org/ (ATT&CK IDs in appendix) CISA reporting — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices Microsoft audit events — https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
mkdir -p "$LAB_AD/report"
python3 - <<'PY'
sections = ['Executive Summary', 'Scope (LAB_AD only)', 'Findings + MITRE IDs', 'Detections (Event IDs)', 'Remediation', 'Purple Retest Notes']
path = __import__('os').path.join(__import__('os').environ.get('LAB_AD', __import__('os').path.expanduser('~/cyberlium-lab/t25-ad')), 'report', 'outline.txt')
open(path, 'w').write('
'.join(f'{i+1}. {s}' for i, s in enumerate(sections)))
print('Report outline ready — chmod 600 recommended')
PYCommand — copy this
chmod 600 "$LAB_AD/report/outline.txt" 2>/dev/null || true grep -E 'Scope|MITRE|Remediation' "$LAB_AD/report/outline.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: Report lab (https://attack.mitre.org/); CISA reporting (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices); Microsoft audit events (https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Every claim ties to lab evidence; fixes verified on $LAB_AD.
Professional tone — ticket-ready titles.
3. Share-safe export
Redact before any blog; mentor copy lab-domain default.
No live cred attachments in zip.
4. What you ship: AD defender report lab pack
Findings + remediation + purple + integrity — chmod 600.
5. What you record before the next lesson
AD report lab pack path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Report lab zip includes stranger-domain DCSync transcript.
Right
AD report lab pack from $LAB_AD. Next: quiz.
Mission: report lab
1) Two finding rows. 2) Remediation before/after proof. 3) Purple loop with retest. 4) Integrity block; chmod 600 index.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum purple retest evidence?”
Knowledge Check
APPLY: Report lab includes:
Multiple choice
Knowledge Check
APPLY: True or False: Attack scripts required in report lab.
True or False
Knowledge Check
APPLY: Report claims must:
Multiple choice