Detections Map
Map emulation TTPs to defender detections on $LAB_RT — ATT&CK technique to log source to rule hypothesis.
Visual · t21_detections_map
Detections map = technique → telemetry → rule idea. $LAB_RT purple. Original Cyberlium.
Red team without detection mapping is just noise — build the table blue can operationalize from your $LAB_RT exercise.
A detections map links each emulated ATT&CK technique to telemetry sources (Sysmon, Windows Security, EDR, proxy, DNS), analytic ideas (Sigma-style descriptions without dumping proprietary rules), and expected outcomes (alert, log-only, gap). Purple team uses the map during and after $LAB_RT to tune SIEM content — not to hide TTPs from defenders. Cyberlium teaches mapping discipline on techniques you ran or planned in RoE — NOT generic rule paste for stranger environments, NOT 'disable alerts so red wins' cheating, NOT maps built from unauthorized intrusions. Honest gaps are gifts to blue — document them in chmod 600 notes.
1. Map columns
Technique ID, emulation step, data source, detection hypothesis, test result (fired/missed), owner (blue/red).
One row per TTP from Modules 4–7 lab artifacts — cross-link evidence IDs.
Command guide
Try these commands — Map columns
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, grep. Reference sites: Sigma rules (https://sigmahq.io/); ATT&CK detections (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender handoff
Write for SOC analyst — plain language, not ego about 'undetectable' tradecraft.
Prioritize gaps that matter to RoE objectives — not every informational log.
3. RoE integrity
Map reflects $LAB_RT exercise only — no stranger breach telemetry.
Refuse rows that require cover-tracks or unauthorized access to produce.
4. What you ship: detections map table
≥6 rows technique→telemetry→hypothesis→result + gap highlight + $LAB_RT scope header.
5. What you record before the next lesson
Detections map path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Build detections map from Shodan RDP sessions you never had RoE for.
- Right: Detections map from $LAB_RT TTPs. Next: Purple Loop.
Mission: detections map
1) Create table columns. 2) Add ≥6 rows from your lab TTPs. 3) Mark two gaps for blue. 4) chmod 600 storage.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Missed alert — bug or tuning?”
APPLY: Detections map links:
APPLY: True or False: Hide TTPs from blue during purple.
APPLY: Honest detection gap: