Lab — Family Callback Rule

“Family” in the title means a rule simple enough to tell a household, including a household of one. You write it in the first person. You may optionally tell people you live with the one-sentence version. You must not phish them, vish them, or quiz them with a fake IT call. If they are not interested, you still finish the file for yourself. Consent to hear a safety sentence is not consent to be a target. Cyberlium does not assign awareness campaigns.

Concrete trigger language looks like: unexpected call/chat/mail that asks for a password, MFA code, seed phrase, card number, wire, gift cards, remote-install, or a door buzz I did not expect. Concrete OOB language looks like: hang up / close thread; open the bank app I already installed; dial the number on MY card; use the IT portal my employer published (typed, not from the lure). Concrete NEVER language looks like: I will not send a test phish to anyone; I will not use SET or Gophish; I will not run a vishing script; I will not tailgate. If a later employer runs a separate phishing-simulation program under THEIR written RoE, that is not this lab.

cat > "$NOTES" << 'EOF'
=== FAMILY CALLBACK RULE (Cyberlium M09 L04) ===
DISCLAIMER: original Cyberlium — not official CEH
RULE: I hang up and call a number I already have
WHERE_NUMBERS_LIVE: (phone book / printed card — fill)
WHO_IT_COVERS: (household — fill)
ETHICS: no lure, no pretext practice on others
EOF

Required keys: DISCLAIMER, TRIGGER, STOP, CALLBACK, MFA, BADGE_OR_DOOR, REPORT, NEVER, ETHICS. Replace parentheticals. The checker fails if placeholders remain, if campaign bait phrases appear (gophish, setoolkit, send test phish, vish my family), or if the disclaimer does not say this is not official EC-Council training. It does not send mail. It does not dial. If you added those, you left the lab.

DISCLAIMER must include the Cyberlium legal sentence in spirit: original curriculum, mapped to the CEH v13 social-engineering domain, not official EC-Council training, not a cert, not exam dumps, completing it does not grant CEH. CALLBACK must name a channel you already have — not “whatever number they left.” MFA must say you never read a one-time code to a caller. REPORT may be “mail client Report phishing” and “number on my card”; do not invent a ministry URL. ETHICS: I will not attack humans to complete this course.

grep -E "DISCLAIMER|RULE|WHERE_NUMBERS_LIVE|WHO_IT_COVERS|ETHICS" "$NOTES"

mkdir -p creates cyberlium-lab. The here-document writes family-callback-rule.txt. Python reads UTF-8 text, checks keys, prints PASS or FAIL. chmod 600 restricts the file to you on Unix-like systems. Windows: WSL or Git Bash for chmod, or tighten NTFS permissions on your user profile. There is no curl to a lookalike, no SMTP library, no SET. If you added those, you left the lab.

Rerun the checker after you edit. A PASS that still says “I will email Dad a fake invoice so he learns” is an ethics fail you catch with your eyes. The confirmation checkbox is you asserting you used your eyes. Do not gist the file. Do not put live passwords or OTPs in it. Sibling notes (se-humans, se-scripts, se-countermeasures) stay; they are not substitutes for this filename.

sudo apt install python3

brew install python3

python3 - << 'PY'
from pathlib import Path
t = (Path.home()/'cyberlium-lab'/'family-callback-rule.txt').read_text(encoding='utf-8')
keys = ['DISCLAIMER','RULE','WHERE_NUMBERS_LIVE','WHO_IT_COVERS','ETHICS']
print('missing', [k for k in keys if k not in t] or 'none')
PY

Authorized lab only: text on YOUR disk. Do not attack others. Do not treat this file as permission to join a red-team people-test at work. Do not title it “Official CEH v13 SE lab.” If you already sent a lure to a classmate, this lab does not launder that. Stop. Delete campaign drafts. This file is forward-looking refusal, not an indulgence.

Keep chmod 600 on the whole social-engineering note set. Empty any file that still contains someone else’s secrets if you pasted those by mistake. Reporting a real phish that arrived in YOUR inbox uses Topic 5 official buttons — still not forwarding the payload into this repo or a group chat.

Run the block on a machine you own. Edit parentheticals. Re-run python until PASS. Then chmod 600. Do not add network lure tools. Do not aim anything at a classmate.

sudo apt install python3

brew install python3

cd "$HOME/cyberlium-lab"

RULE="$HOME/cyberlium-lab/family-callback-rule.txt"
cat > "$RULE" << 'EOF'
=== CYBERLIUM FAMILY CALLBACK RULE (MODULE 9 LAB) ===
DISCLAIMER: This is original Cyberlium teaching mapped to the CEH v13
social-engineering domain. It is NOT official EC-Council training,
NOT a cert, NOT exam dumps, and completing it does NOT grant CEH.

TRIGGER: (unexpected call/chat/mail asking for password, MFA, money, install, or door buzz)
STOP: I leave that channel. I do not argue inside the lure.
CALLBACK: (official app I already have / number on MY card / contact I saved — not the lure's number)
MFA: I never read a one-time code to a caller. I deny prompts I did not start.
BADGE_OR_DOOR: I do not hold a controlled door for an unbadged person; no tailgating homework.
REPORT: (Report phishing in MY mail client; bank number on MY card if money; no payload forwards)
NEVER: I will not send a test phish to anyone (classmates, family, coworkers).
No SET, no gophish, no vishing scripts against humans.
ETHICS: recognize + refuse + RoE. "I was practicing" is not a defense. People are not my lab.
EOF

cat > check_family_callback_rule.py << 'PY'
from pathlib import Path

path = Path.home() / "cyberlium-lab" / "family-callback-rule.txt"
text = path.read_text(encoding="utf-8")
keys = [
"DISCLAIMER",
"TRIGGER",
"STOP",
"CALLBACK",
"MFA",
"BADGE_OR_DOOR",
"REPORT",
"NEVER",
"ETHICS",
]
missing = [k for k in keys if k not in text]
if missing:
raise SystemExit("FAIL missing keys: " + ", ".join(missing))
if "(unexpected call" in text or "(official app I already have" in text:
raise SystemExit("FAIL replace placeholders in your own words")
low = text.lower()
banned = (
"install gophish",
"run gophish",
"setoolkit",
"vish my family",
"phish my class",
)
if any(b in low for b in banned):
raise SystemExit("FAIL campaign language — this lab is a habit file, not a sting")
if "NOT official EC-Council" not in text and "not official EC-Council" not in text:
raise SystemExit("FAIL disclaimer must say this is not official EC-Council training")
if "test phish" not in low and "never send" not in low:
raise SystemExit("FAIL NEVER must forbid sending a test phish")
print("PASS: required headings present for", path)
print("ethics: habit only; chmod 600; NEVER send a test phish")
PY

python3 check_family_callback_rule.py || python check_family_callback_rule.py

ls -l "$RULE"

You now have a personal callback rule that Module 9 can point at: OOB verify, locked notes, no practicing on humans, no fake certification claim. Next — Quiz — Social Engineering — ten APPLY items on refusal and RoE. After the quiz, DoS vs DDoS as Availability Failures begins Module 10, still original Cyberlium, still not a CEH exam dump, still not a flood kit.