Scenario Planning
Scenario planning literacy — exercise objective, threat profile stub, ATT&CK tactic focus, success criteria — purple exercise design on YOUR `$PURPLE_LAB`.
Visual · t35_scenario_planning
Scenario planning = named exercise rows. $PURPLE_LAB. Original Cyberlium.
Purple exercises need written objectives before technique picks — name scenario rows on YOUR lab before unauthorized prod or stranger org sims.
Scenario planning literacy names: exercise objective category (detection validation literacy stub), threat profile category (fictional adversary literacy), ATT&CK tactic focus category, participant roles category (red, blue, purple lead literacy stubs), and success criteria category. Analyst drafts scenario brief on `$PURPLE_LAB` — fictional org, labeled lab assets, objective tied to Module 5 detection gaps — without simulating real customer environments, without stranger org attack scenarios, without weaponized end-to-end kill chains. Cyberlium teaches exercise design vocabulary on YOUR notes under $HOME/cyberlium-lab/t35-purple/. Refused: prod sim without RoE, stranger org scenarios, crime facilitation playbooks. Lab row: scenario brief (objective, threat profile, tactic focus, roles, success criteria).
1. Named scenario rows
Objective, threat profile, tactic focus, roles, success criteria — five literacy anchors.
All assets fictional on `$PURPLE_LAB` — not live customer org data.
Command guide
Try these commands — Named scenario rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ Atomic Red Team — https://github.com/redcanaryco/atomic-red-team Sigma — https://sigmahq.io/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/exercises/exercise-plan-template.md" <<'EOF'
# Purple Exercise Plan — YOUR template
## Metadata
- Exercise ID: PURPLE-LAB-001
- Date (UTC): [fill]
- Purple lead: [fictional name]
- Scope: YOUR lab VMs only — RFC1918
## Objectives
- Validate failed-logon-lab.yml fires on seeded auth.jsonl
- Optional: T1082 on lab VM — detection logging check
## Techniques (authorized)
| ID | Name | Method | Detection rule |
|---|---|---|---|
| T1110.001 | Password Guessing | jsonl replay | failed-logon-lab.yml |
| T1082 | System Info | optional safe atomic | [your rule or log review] |
## Out of scope
- Ransomware; credential dump; stranger networks
## Success criteria
- Rule MATCH on UT-01; findings logged; coverage CSV updated
EOFCommand — copy this
grep -E 'T1110|T1082|Out of scope|failed-logon' "$PURPLE_LAB/exercises/exercise-plan-template.md"
Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Atomic Red Team (https://github.com/redcanaryco/atomic-red-team); Sigma (https://sigmahq.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Detection-first objective
Success criteria cite detection coverage — not 'compromise achieved' alone.
Link Module 6 atomic cards as planned validation path.
3. $PURPLE_LAB boundary
Scenario briefs on YOUR lab notes only — not stranger org attack sims.
Refused: prod exercise without RoE, weaponized playbooks, live victim data.
4. What you ship: scenario brief
Objective + threat profile + tactic focus + roles + success criteria + NEVER stranger org sim line.
5. What you record before the next lesson
Scenario brief path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Design purple exercise targeting stranger cloud tenant as 'realistic ATT&CK coverage.'
- Right: Scenario brief from `$PURPLE_LAB` lab stub. Next: Technique Selection.
Mission: scenario brief
1) Name five scenario planning rows. 2) Fictional org and labeled lab assets. 3) Success criteria tied to detection validation. 4) Write NEVER stranger org sim line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Detection-first vs compromise-first — literacy split?”
APPLY: Scenario planning on Cyberlium uses:
APPLY: True or False: Stranger org scenarios belong in purple exercise design.
APPLY: Scenario brief includes: