Technique Selection
Technique selection literacy — ATT&CK mapping, allowlist alignment, detection gap priority, atomic vs manual stub — technique rows on YOUR `$PURPLE_LAB`.
Visual · t35_technique_selection
Technique selection = named ATT&CK rows. $PURPLE_LAB. Original Cyberlium.
Pick techniques that close detection gaps — name ATT&CK selection rows on YOUR lab RoE allowlist, not unauthorized technique sprawl.
Technique selection literacy names: ATT&CK technique ID row category, RoE allowlist alignment check category, detection gap priority link category, atomic vs manual execution stub category, and expected blue outcome category. Analyst documents technique selection matrix on `$PURPLE_LAB` scenario from 7-1 — three techniques with gap rationale, RoE cross-check, atomic card reference — without selecting techniques outside allowlist, without chaining into unauthorized kill paths, without prod technique execution. Cyberlium teaches disciplined technique picking — purple coordination on YOUR notes. Refused: allowlist bypass, weaponized chains, stranger org techniques. Lab row: technique selection matrix (three techniques, gap link, RoE check, expected outcome).
1. Named selection rows
Technique ID, allowlist check, gap priority, atomic/manual stub, expected outcome — five literacy anchors.
Each technique cites detection gap from Module 5 — not random ATT&CK browsing.
Command guide
Try these commands — Named selection rows
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE technique selection (https://attack.mitre.org/); Atomic Red Team (https://github.com/redcanaryco/atomic-red-team); Splunk security content (https://github.com/splunk/security_content). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Allowlist discipline
Technique outside RoE allowlist requires amendment stub — document before selection.
Link Module 6-2 purple RoE — same allowlist thread.
3. Refused
No unauthorized kill chains; no allowlist bypass; no prod technique runs.
Selection literacy supports coverage — not red-team technique tourism.
4. What you ship: technique selection matrix
Three techniques + gap link + RoE check + expected outcome + NEVER allowlist bypass line.
5. What you record before the next lesson
Technique selection matrix path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Select ten ATT&CK techniques outside RoE allowlist because 'more coverage is better.'
- Right: Technique selection matrix from `$PURPLE_LAB` scenario brief. Next: Exercise Comms.
Mission: technique selection matrix
1) Name five technique selection rows. 2) Three techniques with gap rationale. 3) RoE allowlist cross-check each. 4) Write NEVER allowlist bypass line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Gap priority vs technique novelty — literacy tie-break?”
APPLY: Technique selection literacy uses:
APPLY: True or False: Allowlist bypass is acceptable for coverage.
APPLY: Technique matrix includes: