Lab — Capstone
Execute capstone on `$PURPLE_LAB` — checklist, lab path, evidence pack sealed; zero weaponized refs.
Visual · t35_capstone_lab
Capstone: checklist × $PURPLE_LAB literacy evidence. Original Cyberlium.
Close the Purple Teaming literacy loop — detections tested, coverage mapped, findings shipped — without stranger org sims or weaponized playbooks.
Walk Topic 35 checklist on YOUR `$PURPLE_LAB`: verify RoE, lab path current, DE through findings packs indexed, scan for weaponized playbook refs and stranger org sim notes (must be zero). Update index with capstone UTC completion. Integrity paragraph: lab VM discipline and coverage/tuning key insight from YOUR path. No stranger org attack sims, no weaponized red playbooks, no unauthorized prod atomic or rule deploy, no blind-side prod SOC. Optional mentor review — three clarity questions. Secure notes chmod 600 after if brief requires.
1. Execute checklist
Check each row; link artifact or N/A; confirm zero weaponized refs in any file.
Scan sealed pack for unauthorized prod URLs — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ Sigma — https://sigmahq.io/ Atomic Red Team — https://github.com/redcanaryco/atomic-red-team Elastic detection — https://www.elastic.co/guide/en/security/current/rules-ui.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
grep NEVER "$PURPLE_LAB/notes/no-stranger-sims.txt"
grep -E 'HARD BAN|T1486|T1003' "$PURPLE_LAB/atomic/safe-tests-list.txt" "$PURPLE_LAB/atomic/atomic-literacy.txt"
echo '=== Capstone: Sigma stub → jq test → exercise plan → coverage CSV → findings backlog ==='
jq -c 'select(.event_id==4625 and .user=="jsmith")' "$PURPLE_LAB/telemetry/auth.jsonl"
grep validated "$PURPLE_LAB/coverage/coverage.csv"
grep '\[ \]' "$PURPLE_LAB/notes/capstone-checklist.txt" | head -5
python3 - <<'PY'
import os
lab = os.environ.get('PURPLE_LAB', os.path.expanduser('~/cyberlium-lab/t35-purple'))
path = os.path.join(lab, 'notes', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
'Purple Teaming Capstone',
'scope: YOUR $HOME/cyberlium-lab/t35-purple/ + YOUR lab VMs only',
'detection: failed-logon-lab.yml Sigma stub (T1110.001)',
'telemetry: FAKE auth.jsonl — jq validated UT-01 MATCH',
'atomic: clone/read literacy + safe T1082 list — Invoke-AtomicTest optional on YOUR VM',
'exercise: PURPLE-LAB-001 plan + coverage.csv + findings backlog',
'never: stranger-network sims / ransomware atomics / credential dump homework',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'scope|never|failed-logon|coverage' "$PURPLE_LAB/notes/capstone-summary.txt"
═══ WINDOWS ═══
Capstone on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t35-purple/notes/no-stranger-sims.txt | Select-String NEVER Get-Content $HOME/cyberlium-lab/t35-purple/notes/capstone-summary.txt | Select-String never Get-Content $HOME/cyberlium-lab/t35-purple/coverage/coverage.csv | Select-String T1110
Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Atomic Red Team (https://github.com/redcanaryco/atomic-red-team); Elastic detection (https://www.elastic.co/guide/en/security/current/rules-ui.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Integrity paragraph
RoE + lab VM scope + coverage/tuning key → professional handoff idea from YOUR lab path.
Name what breaks if you skip scope or run stranger org sims — ethics tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 36 DevSecOps on separate authorized track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + integrity paragraph + zero weaponized scan.
5. What you record before the next lesson
Capstone pack path. $PURPLE_LAB quiet.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Capstone includes weaponized red playbook walkthrough as bonus exhibit.
- Right: Capstone complete on $PURPLE_LAB with full teardown. Next: topic quiz.
Mission: Topic 35 capstone
1) Walk checklist with evidence links. 2) Integrity paragraph from your path. 3) Seal pack — zero weaponized refs. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
APPLY: Capstone target:
APPLY: True or False: Weaponized playbooks earn capstone credit.
APPLY: Capstone teardown includes: