Lab — Design
ATT&CK exercise design lab on `$PURPLE_LAB` — scenario brief, technique matrix, exercise comms bundled.
Visual · t35_design_lab
Lab: exercise design pack on YOUR $PURPLE_LAB. Original Cyberlium.
Ship exercise design artifacts from YOUR lab stub — scenario, techniques, comms — zero stranger org sims or weaponized playbooks.
On YOUR `$PURPLE_LAB` per brief: (1) scope proof — labeled lab scenario under $HOME/cyberlium-lab/t35-purple/; (2) scenario brief Module 7-1; (3) technique selection matrix Module 7-2; (4) exercise comms plan Module 7-3; (5) hotwash preview stub (objectives met, gaps noted); (6) integrity — `$PURPLE_LAB` only, no stranger org sims, no weaponized chains, no prod exercise without RoE; (7) chmod 600 pack. Cross-link Modules 5–6 detection and atomic work — exercise design defender literacy only.
1. Lab deliverables
Scenario + technique matrix + comms cross-indexed — single exercise thread.
Hotwash preview links gaps to Module 8 coverage rows.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ Sigma — https://sigmahq.io/ Atomic Red Team — https://github.com/redcanaryco/atomic-red-team
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/exercises/PURPLE-LAB-001.md" <<'EOF'
# Exercise PURPLE-LAB-001 — FAKE authorized lab
**Scope:** $HOME/cyberlium-lab/t35-purple/ + YOUR lab VMs
## Flow
1. Replay auth.jsonl; jq validate failed-logon-lab.yml (UT-01 MATCH)
2. Document detection fired: Y (jsmith 3x4625→4624)
3. Optional T1082 on YOUR VM — log review only if brief assigns
4. Record finding PURPLE-FND-001: threshold tuning needed
## Integrity
- No ransomware; no credential dump; no stranger-network sims
- Prefer this markdown plan over mandatory Atomic install
EOFCommand — copy this
grep -E 'PURPLE-FND|failed-logon|Integrity|Atomic' "$PURPLE_LAB/exercises/PURPLE-LAB-001.md" ls "$PURPLE_LAB/exercises/"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t35-purple/exercises/PURPLE-LAB-001.md | Select-String Integrity
Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Atomic Red Team (https://github.com/redcanaryco/atomic-red-team). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Ethics bar
Zero stranger org references; zero weaponized chain notes; fictional org only.
Success criteria cite detection validation — not compromise alone.
3. Teardown
Secure notes chmod 600; no exercise outputs sent to real stakeholders without authorization.
Archive stub optional per brief.
4. What you ship: exercise design pack
Scenario + technique matrix + comms + hotwash stub + integrity — chmod 600.
5. What you record before the next lesson
Exercise design pack path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Design lab includes stranger org attack scenario as primary deliverable.
- Right: Exercise design pack on `$PURPLE_LAB`. Next: quiz.
Mission: exercise design lab
1) Scope and scenario proof. 2) Scenario brief and technique matrix. 3) Exercise comms plan. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum hotwash rows if brief sparse?”
APPLY: Design lab scope:
APPLY: True or False: Weaponized chains earn design lab credit.
APPLY: Design lab pack should: