Lab — Purple Capture
Run one purple cycle on $LAB_RT — detections map, blue handoff, tune/retest or documented gap.
Visual · t21_purple_lab
Lab: purple loop on $LAB_RT. Original Cyberlium.
Close one purple loop on lab hosts blue owns — measure detections, not stealth on strangers.
On YOUR $LAB_RT per RoE with blue partner or mentor as blue: (1) execute one planned TTP or replay prior lab hop; (2) collect defender telemetry; (3) complete detections map row with fired/missed; (4) blue tunes one rule or documents accepted gap; (5) optional re-test confirms alert; (6) deliver evidence-for-blue pack redacted, chmod 600. No disabling EDR to fake success, no log clearing, no unauthorized targets. Success metric written: coverage improved or gap ticket opened — not 'red remained invisible.'
1. Cycle execution
Plan TTP + expected alert before action — no surprise attacks outside RoE.
UTC timestamps on every step for timeline handoff.
Command guide
Try these commands — Cycle execution
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: journalctl, ss, curl. Reference sites: Sigma HQ (https://sigmahq.io/); Elastic Security (https://www.elastic.co/guide/en/security/current/prebuilt-rules-management.html); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Collaboration
Red shares technique intent with blue pre-exercise when RoE requires — purple not black box cheating.
Meeting notes: gap, owner, retest date — professional tone.
3. Stop conditions
Stop if telemetry collection requires unauthorized access or cover-tracks.
Teardown lab artifacts after handoff — revert snapshots per policy.
4. What you ship: purple lab pack
Detections map update + blue handoff + tune/retest note + success metric — chmod 600.
5. What you record before the next lesson
Purple lab pack path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Purple lab = disable SIEM and claim undetectable red win.
- Right: Purple lab pack with honest detection outcome. Next: quiz.
Mission: purple lab
1) Execute one RoE TTP. 2) Update detections map. 3) Deliver blue handoff. 4) Document tune/retest or gap ticket.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Missed alert — open gap ticket wording?”
APPLY: Purple lab measures:
APPLY: True or False: Disable EDR for purple success.
APPLY: Purple lab deliverable: