Red › Module 10 › Lesson 2
Lab Path
Emulation path diagram for YOUR $LAB_RT engagement — TTP hops, purple breakpoints, RoE borders.
Visual · t21_lab_path
Lab path = visual emulation chain on in-scope lab hosts. Original Cyberlium.
Opening
Draw the path you actually emulated on RoE hosts — not a fantasy map through someone else's forest.
Document red-team path from initial access through persistence/lateral (if in scope) to objective on $LAB_RT: diagram or numbered steps with hostnames, technique IDs, detection outcomes, and purple tune points. Mark RoE VLAN border — stop line for pivot and exfil. Include defender breakpoints where alerts fired or missed. No paths through unauthorized subnets, no 'then we dumped stranger domain' fiction. Mermaid or sketch chmod 600 in private notes. Cross-link report timeline and ATT&CK map rows.
1. Path elements
Entry, persistence (if used), lateral edges, objective, synthetic exfil marker (if tested), purple retest hop.
Each step links evidence index row and detection outcome.
Command guide
Try these commands — Path elements
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Lab path review — https://attack.mitre.org/matrices/enterprise/ (coverage check) Purple evidence — https://sigmahq.io/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
Built-in (iproute2)
macOS:
Command — copy this
brew install nmap
Use: netstat
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Use: netstat
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t21-rt/lab.env" 2>/dev/null || export LAB_HOST=${LAB_HOST:-127.0.0.1}
nmap -sn "$LAB_HOST" 2>/dev/null | head -10
ss -tulpn 2>/dev/null | head -12
grep -c . "$HOME/cyberlium-lab/t21-rt/technique-ids.txt" 2>/dev/null || echo 'technique notes: add from module 2'Primary tools to practice this lesson: nmap, ss. Reference sites: Lab path review (https://attack.mitre.org/matrices/enterprise/); Purple evidence (https://sigmahq.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. RoE overlay
Draw VLAN border — refused actions outside line labeled N/A.
Note time box met Y/N and teardown completed Y/N.
3. Purple breakpoints
Mark detect fired / missed / tuned — show loop closed or gap ticket.
Honest literacy-only path valid if brief did not require live emulation.
4. What you ship: lab path diagram
Emulation path with RoE border + purple breakpoints — chmod 600.
5. What you record before the next lesson
Lab path diagram path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Draw path including stranger AD cred dump hop.
Right
Lab path documented within $LAB_RT. Next: Evidence Pack.
Mission: lab path diagram
1) Map steps from entry to objective on RoE hosts. 2) Mark VLAN boundary. 3) Add purple detection outcomes. 4) Link evidence rows.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Diagram vs numbered list for capstone?”
Knowledge Check
APPLY: Lab path documents:
Multiple choice
Knowledge Check
APPLY: True or False: Unauthorized pivot belongs on path.
True or False
Knowledge Check
APPLY: Path should show:
Multiple choice