Lab Path

Purple Teaming literacy path on `$PURPLE_LAB` — lab setup to mentor handoff with ethics gates at every station.

Lab Path• Audio Walkthrough

00:00/02:57

Visual · t35_lab_path

Lab path = visual purple chain on YOUR $PURPLE_LAB. Original Cyberlium.

Draw the path from lab scope to mentor handoff — with stop signs at every stranger-network shortcut and weaponized playbook lane.

Document literacy path: `$PURPLE_LAB` setup → purple concepts → detection engineering → sigma/SIEM → testing → atomic sim → exercise design → coverage/tuning → findings → capstone. Ethics gates: stranger org attack sims, weaponized red playbooks, unauthorized prod atomic or rule deploy, blind-side prod SOC, EDR disable to pass detection — refused paths labeled red. UTC milestones and artifact IDs per station. Mermaid or sketch chmod 600. Honest N/A if brief skipped live lab host — labeled. Defender breakpoint: where RoE or scope discipline prevented out-of-scope purple action.

1. Path stations

Setup, concepts, DE, sigma/SIEM, testing, atomic, exercise design, coverage, findings, handoff — ten minimum stations.

Each station links evidence index row and module lesson ID.

Command guide

Try these commands — Path stations

═══ LINUX / macOS (Terminal Practice) ═══

Check system state and user context

Command — copy this

id
whoami
uname -a

Inspect network sockets listening for connections

Command — copy this

ss -tuln 2>/dev/null || netstat -tuln

Audit active processes

Command — copy this

ps aux | grep -v "\[" | head -15

═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information

Command — copy this

whoami /all
Get-ComputerInfo | Select-Object CsName, OsName, OsVersion

Primary tools to practice this lesson: curl, grep. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Atomic Red Team (https://redcanary.com/atomic-red-team/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.