Red › Module 3 › Lesson 2
Emulation Plan
Emulation plans sequence TTPs on $LAB_RT within RoE — methodology document, not operational attack guide for strangers.
Visual · rt_emulation_plan
Emulation plan literacy. $LAB_RT only. Original Cyberlium.
Opening
A good emulation plan fits on one page: scope, TTPs, timeline, purple contacts.
Emulation plans document campaign narrative on $LAB_RT: starting assumptions, technique sequence with ATT&CK IDs, C2 constraints, stop conditions, and purple-team check-in points. Plans align red actions with blue detection exercises — not open-ended compromise of unauthorized hosts. Cyberlium teaches plan structure without weapon cookbooks or stranger phishing steps. Next: Success Criteria.
1. Plan sections professionals expect
Executive summary, scope ($LAB_RT hosts), RoE reference, threat profile (group or custom), technique timeline, C2/lab-only constraints, communication plan, and rollback/snapshot notes.
Each technique row: ID, host role, expected artifact, detection owner, stop-if trigger.
Command guide
Try these commands — Plan sections professionals expect
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: python3, curl. Reference sites: Emulation plan template (https://attack.mitre.org/resources/adversary-emulation-plans/); ATT&CK groups (https://attack.mitre.org/groups/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Timeline and dependency realism
Sequence matters: initial access before persistence before lateral on $LAB_RT AD lab. Realistic pacing helps blue practice alert correlation — spray-everything-in-one-hour teaches little.
Forbidden: timeline steps on production, mass email phases, or ransomware deployment outside isolated $LAB_RT fixtures.
3. Plans are purple-team contracts
Share plan summary with blue lead before start — surprises erode trust. Plans attach to RoE pack and ATT&CK Navigator layer for $LAB_RT.
Ship: emulation plan outline with five technique rows for $LAB_RT. Next: Success Criteria.
4. What you ship: emulation plan outline for $LAB_RT
Outline: scope, five technique rows, timeline, purple contact. $LAB_RT only. NEVER stranger steps. chmod 600.
5. What you record before the next lesson
Date. Emulation plan outline. $LAB_RT named. File t21-m03-l02-emulation-plan.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write plan targeting classmate cloud tenant. Include phishing kit procurement steps.
Right
Write emulation plan outline for $LAB_RT. Next: Success Criteria.
Mission: draft emulation plan outline
1) Write plan sections list. 2) Add five technique rows with ATT&CK IDs for $LAB_RT. 3) Note purple contact line. 4) chmod 600. Never include stranger or mass-email phases.
Stuck? Ask Cyberlium AI Mentor
Plans blue can read beat secret operator improvisation.
Knowledge Check
APPLY: Emulation plan on Cyberlium documents:
Multiple choice
Knowledge Check
APPLY: True or False: Emulation plans should be shared with blue before $LAB_RT execution.
True or False
Knowledge Check
APPLY: Technique timeline on $LAB_RT should:
Multiple choice