Purple › Module 6 › Lesson 4
Lab — Atomic
Atomic simulation lab on `$PURPLE_LAB` — atomic test card, RoE stub, safe test checklist bundled.
Visual · t35_atomic_lab
Lab: atomic simulation pack on YOUR $PURPLE_LAB lab VM. Original Cyberlium.
Opening
Ship atomic simulation artifacts from YOUR lab VM — test card, RoE, safe checklist — zero stranger-network sims or weaponized playbooks.
On YOUR `$PURPLE_LAB` per brief: (1) scope proof — lab VM hostname and RoE reference labeled; (2) atomic test card Module 6-1; (3) purple RoE stub Module 6-2; (4) safe test checklist Module 6-3; (5) detection validation result stub (telemetry observed, rule fired/not fired honesty); (6) integrity — `$PURPLE_LAB` only, no stranger org sims, no prod atomics, no weaponized red playbooks; (7) chmod 600 pack. Cross-link Modules 4–5 detection rules — professional atomic literacy, not offensive cookbooks.
1. Lab deliverables
Atomic card + RoE + safe checklist cross-indexed to one lab VM.
Detection validation cites honest rule-fire result — not fabricated pass.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Atomic Red Team — https://github.com/redcanaryco/atomic-red-team MITRE ATT&CK — https://attack.mitre.org/ Sigma — https://sigmahq.io/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/atomic/clone-read-steps.txt" <<'EOF'
Atomic repo literacy — clone/read (YOUR lab workstation):
git clone https://github.com/redcanaryco/atomic-red-team.git
cd atomic-red-team/atomics/T1082
head -40 T1082.yaml
grep -E 'name:|executor:' T1082.yaml | head -10
List banned-for-homework tests (document only):
ls ../T1486 2>/dev/null && echo 'RANSOMWARE — read only, never run'
ls ../T1003 2>/dev/null && echo 'CRED DUMP — read only, never run'
Output: safe-tests-list.txt + exercise-roe.md — no mandatory install
EOFCommand — copy this
grep -E 'git clone|T1082|RANSOMWARE|CRED DUMP' "$PURPLE_LAB/atomic/clone-read-steps.txt" curl -sS https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1082 | head -5
═══ WINDOWS ═══
Optional: YOUR lab Windows VM only — safe T1082 after RoE approved
Command — copy this
Get-Content $HOME/cyberlium-lab/t35-purple/atomic/safe-tests-list.txt | Select-String T1082 Get-Content $HOME/cyberlium-lab/t35-purple/atomic/exercise-roe.md | Select-String Prohibited
Invoke-AtomicTest T1082 -TestNumbers 1 # uncomment ONLY on YOUR lab VM
Primary tools to practice this lesson: grep, curl. Reference sites: Atomic Red Team (https://github.com/redcanaryco/atomic-red-team); MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Each row cites lab VM source — not generic atomic blog advice.
Zero stranger-network or prod references in pack.
3. Teardown
Cleanup verified; notes chmod 600; snapshot restored per brief.
Archive stub optional per brief.
4. What you ship: atomic lab pack
Atomic card + RoE + safe checklist + validation result + integrity — chmod 600.
5. What you record before the next lesson
Atomic lab pack path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Atomic lab includes full attack chain cookbook as bonus deliverable.
Right
Atomic lab pack on `$PURPLE_LAB` lab VM. Next: quiz.
Mission: atomic lab
1) Scope and lab VM proof. 2) Atomic test card and RoE stub. 3) Safe test checklist and validation result. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum validation result rows if rule did not fire?”
Knowledge Check
APPLY: Atomic lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Weaponized attack chains earn atomic lab credit.
True or False
Knowledge Check
APPLY: Atomic lab pack should:
Multiple choice