Lab Path

Emulation path diagram for YOUR $LAB_RT engagement — TTP hops, purple breakpoints, RoE borders.

Lab Path• Audio Walkthrough

00:00/02:49

Visual · t21_lab_path

Lab path = visual emulation chain on in-scope lab hosts. Original Cyberlium.

Draw the path you actually emulated on RoE hosts — not a fantasy map through someone else's forest.

Document red-team path from initial access through persistence/lateral (if in scope) to objective on $LAB_RT: diagram or numbered steps with hostnames, technique IDs, detection outcomes, and purple tune points. Mark RoE VLAN border — stop line for pivot and exfil. Include defender breakpoints where alerts fired or missed. No paths through unauthorized subnets, no 'then we dumped stranger domain' fiction. Mermaid or sketch chmod 600 in private notes. Cross-link report timeline and ATT&CK map rows.

1. Path elements

Entry, persistence (if used), lateral edges, objective, synthetic exfil marker (if tested), purple retest hop.

Each step links evidence index row and detection outcome.

Command guide

Try these commands — Path elements

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Lab path review — https://attack.mitre.org/matrices/enterprise/ (coverage check) Purple evidence — https://sigmahq.io/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install nmap

Built-in (iproute2)

macOS:

Command — copy this

brew install nmap

Use: netstat

Windows:

Command — copy this

choco install nmap  # or download https://nmap.org/download.html

Use: netstat

═══ LINUX / macOS ═══

Command — copy this

source "$HOME/cyberlium-lab/t21-rt/lab.env" 2>/dev/null || export LAB_HOST=${LAB_HOST:-127.0.0.1}
nmap -sn "$LAB_HOST" 2>/dev/null | head -10
ss -tulpn 2>/dev/null | head -12
grep -c . "$HOME/cyberlium-lab/t21-rt/technique-ids.txt" 2>/dev/null || echo 'technique notes: add from module 2'

Primary tools to practice this lesson: nmap, ss. Reference sites: Lab path review (https://attack.mitre.org/matrices/enterprise/); Purple evidence (https://sigmahq.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.