Defensive › Module 10 › Lesson 3
Walkthrough
Narrate defender walk — checklist order on $LAB; what SOC would see if you skipped steps.
Visual · t16_walkthrough
Walkthrough = tell the story of YOUR defensive lab. Original Cyberlium.
Opening
A walkthrough is how you prove you can explain defense — not evade it.
Write walkthrough script: start RoE and $LAB inventory, hardening spot-check, pull local auth log sample, show central test line, cite policy/patch/change note, demonstrate backup restore pointer, awareness personal pledge. One paragraph: if you skipped central logging or restore test, what blind spots remain. Perform mentally or on $LAB — no live demo on unauthorized networks.
1. Walk order
RoE → hardening → local logs → central → policy/patch → backup → awareness.
Match checklist row to evidence index row.
Command guide
Try these commands — Walk order
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: curl, ss, journalctl. Reference sites: MITRE ATT&CK browse (https://attack.mitre.org/); CIS Controls (https://www.cisecurity.org/controls). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender lens
What alerts would fire on missing patches or auth failures you documented.
Time sync mentioned before correlation claims.
3. Gap honesty
Mark N/A hardware honestly — gap is fix plan on YOUR bench, not stranger targets.
No filler with unauthorized scans.
4. What you ship: walkthrough script
Ordered narrative + blind-spot paragraph + defender alert mention.
5. What you record before the next lesson
Walkthrough script path.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Walkthrough includes 'then we scanned the dorm subnet.'
Right
Walkthrough script done. Next: capstone lab.
Mission: walkthrough draft
1) Write eight-step walk order. 2) One paragraph blind spots if steps skipped. 3) One defender alert example from your logs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Blind spot if no restore test?”
Knowledge Check
APPLY: Walkthrough order starts with:
Multiple choice
Knowledge Check
APPLY: True or False: Dorm subnet scan belongs in walkthrough.
True or False
Knowledge Check
APPLY: Blind-spot paragraph names:
Multiple choice