Purple › Module 6 › Lesson 3
Safe Lab Tests
Safe lab test literacy — pre-flight checks, isolated VMs, cleanup verification, detection observer role — safe atomic execution on YOUR `$PURPLE_LAB`.
Visual · t35_safe_lab_tests
Safe lab tests = named pre-flight rows. $PURPLE_LAB. Original Cyberlium.
Opening
Atomic tests can break lab hosts — name pre-flight and cleanup rows on YOUR lab VMs before execution, never skip observer role or rollback.
Safe lab test literacy names: snapshot or restore point category, network isolation check category, blue team observer notified category, atomic executor dry-run stub category, and post-test cleanup verification category. Analyst documents safe test checklist on `$PURPLE_LAB` lab VM — ties each row to RoE from 6-2 and atomic card from 6-1 — without running destructive atomics without snapshot, without disabling EDR to 'pass' detection, without leaving persistence on lab host. Cyberlium teaches honest safe execution — purple coordination literacy on YOUR notes. Refused: EDR disable, skip cleanup, unauthorized prod atomic. Lab row: safe test checklist (five pre-flight rows, cleanup verification, UTC).
1. Named pre-flight rows
Snapshot, isolation check, observer notified, dry-run stub, cleanup verification — five literacy anchors.
Each row has pass/fail criteria — not subjective 'should be fine.'
Command guide
Try these commands — Named pre-flight rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE T1082 — https://attack.mitre.org/techniques/T1082/ Atomic T1082 — https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1082 Atomic Red Team — https://github.com/redcanaryco/atomic-red-team
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
curl -sS https://attack.mitre.org/techniques/T1082/ | head -10
cat > "$PURPLE_LAB/atomic/safe-tests-list.txt" <<'EOF'
Safe Atomic tests for YOUR lab VM (optional — read before run):
T1082 — System Information Discovery (hostname, OS version — low risk)
Document only: list atomics/T1082/T1082.yaml test names via clone/read
Tabletop alternative (preferred):
Replay telemetry/auth.jsonl + validate failed-logon-lab.yml with jq
NEVER run on lab VM:
T1486 ransomware; T1003 credential dump; T1059 destructive payloads
Invoke-AtomicTest example (YOUR VM ONLY — optional):
# Invoke-AtomicTest T1082 -TestNumbers 1 -GetPrereqs
# Invoke-AtomicTest T1082 -TestNumbers 1
Comment out until exercise plan approved — markdown plan is sufficient
EOFCommand — copy this
grep -E 'T1082|T1486|T1003|NEVER|Invoke-AtomicTest' "$PURPLE_LAB/atomic/safe-tests-list.txt"
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE T1082 (https://attack.mitre.org/techniques/T1082/); Atomic T1082 (https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1082); Atomic Red Team (https://github.com/redcanaryco/atomic-red-team). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Observer discipline
Blue observer confirms detection pipeline live before red executes — document UTC on lab stub.
Failed pre-flight aborts test — no 'run anyway' on lab host.
3. Refused
No EDR disable to pass detection; no skip cleanup; no prod atomic without RoE.
Safe test literacy supports repeatable purple work — not reckless sims.
4. What you ship: safe test checklist
Five pre-flight rows + cleanup verification + observer UTC + NEVER EDR disable line.
5. What you record before the next lesson
Safe test checklist path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Disable EDR on lab VM so atomic 'passes' detection validation faster.
Right
Safe test checklist from `$PURPLE_LAB` lab VM stub. Next: Atomic Lab.
Mission: safe test checklist
1) Name five safe test rows. 2) Pass/fail criteria per row. 3) Observer notification UTC stub. 4) Write NEVER EDR disable line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Snapshot vs restore point — literacy default?”
Knowledge Check
APPLY: Safe lab test literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Failed pre-flight should abort atomic test.
True or False
Knowledge Check
APPLY: Safe test checklist includes:
Multiple choice