Lab — ATT&CK Map
Pack ATT&CK literacy — matrix note, technique table, Navigator legend — literacy file only, dest $LAB_RT.
Visual · rt_attack_lab
Lab: write ATT&CK pack. $LAB_RT only. Original Cyberlium.
ATT&CK pack before emulation — same discipline purple teams expect.
Lessons 2-1 through 2-3 covered matrix orientation, tactics/techniques, and Navigator layers. This lab ships the combined artifact: matrix note, technique table template, Navigator legend — all for $LAB_RT. No live TTP execution required — paperwork first. Next: Quiz — ATT&CK Literacy.
1. Lab contract: write the ATT&CK pack
Create $HOME/cyberlium-lab/t21-m02-l04-attack-lab.txt merging matrix orientation, technique table header, Navigator legend, and NEVER stranger lines.
Optional: three technique IDs colored for $LAB_RT — placeholders OK if offline.
Command guide
Try these commands — Lab contract: write the ATT&CK pack
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, jq, grep. Reference sites: ATT&CK STIX data (https://github.com/mitre/cti); Enterprise Matrix (https://attack.mitre.org/matrices/enterprise/); Atomic Red Team (https://redcanary.com/atomic-red-team/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ATT&CK misuse habits
Grep notes for production or classmate host examples — redact to $LAB_RT. If a tutorial maps ATT&CK to a public breach story, extract detection lessons only — not attack replication on strangers.
Classmates build their own ATT&CK packs for their $LAB_RT — not yours.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Emulation Planning.
Clean ATT&CK packs make Module 3 emulation plans defensible.
4. What you ship: ATT&CK pack for $LAB_RT
Matrix + technique table + Navigator legend merged. $LAB_RT named. chmod 600. No stranger targets.
5. What you record before the next lesson
Date. ATT&CK pack path. $LAB_RT named. File t21-m02-l04-attack-lab.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Add classmate VM techniques to pack. Skip file and emulate TTPs on production.
- Right: Write YOUR ATT&CK pack for $LAB_RT. chmod 600. Next: Quiz — ATT&CK Literacy.
Mission: freeze YOUR ATT&CK pack on disk
1) Merge matrix, technique table, Navigator sections. 2) Name $LAB_RT. 3) chmod 600. Never list stranger URLs as emulation targets.
Stuck? Ask Cyberlium AI Mentor
ATT&CK packs bridge red plans and blue detections — keep them scoped.
APPLY: This lab requires:
APPLY: True or False: ATT&CK pack should include Navigator layer legend.
APPLY: A tutorial emulates TTPs on a public domain. You: