Defense Signals
Map MSF lab actions to defender signals — EDR, IDS, auth logs on $LAB.
Visual · msf_defense_signals
Every lab action has a blue-team mirror. Original Cyberlium.
Red literacy without blue signals is incomplete.
Handlers → unexpected outbound connections. Aux scans → port spikes and auth failures. Sessions/meterpreter → process injection, new services. Post → credential access patterns. Document signals for YOUR $LAB exercise — build defender vocabulary, not evasion recipes for production.
1. Handler and payload signals
New outbound to LPORT, rare process parent chains.
Firewall logs on lab attacker/victim pair.
Command guide
Try these commands — Handler and payload signals
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: msfconsole, curl. Reference sites: Defense signals (https://attack.mitre.org/); Elastic detection (https://www.elastic.co/security). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Aux and scan signals
Connection attempts, 401/403 bursts, SNMP/SMB noise.
Rate-based IDS rules trigger on scan modules.
3. Session/post signals
Privilege changes, new scheduled tasks (if brief includes), LSASS access attempts in EDR.
Use ATT&CK technique IDs as labels in notes.
4. What you ship: signal matrix
Three MSF action types → defender signal mapping.
5. What you record before the next lesson
Signal matrix path.
6. Wrong vs right: stranger hosts vs YOUR lab VM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Document signals only to evade EDR on real orgs.
- Right: Signal matrix for $LAB. Next: logging detection.
Mission: defense signal matrix
1) Map handler to one signal. 2) Map aux scan to one signal. 3) Map post to one signal.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Example IDS rule for scan noise?”
APPLY: Aux scans may trigger:
APPLY: True or False: Blue signals matter in this topic.
APPLY: Meterpreter may cause:
Logging Detection
Part of Metasploit Framework — Defense View and Capstone Lab.
Checklist
Part of Metasploit Framework — Defense View and Capstone Lab.
Capstone Lab
Part of Metasploit Framework — Defense View and Capstone Lab.