Red › Module 3 › Lesson 4
Lab — Plan Draft
Pack emulation plan — intel inputs, plan outline, success criteria — literacy file only, dest $LAB_RT.
Visual · rt_plan_lab
Lab: write plan pack. $LAB_RT only. Original Cyberlium.
Opening
Plan pack before campaign — intel, sequence, criteria on paper first.
Lessons 3-1 through 3-3 covered intel inputs, emulation plan structure, and success criteria. This lab merges them into one plan pack for $LAB_RT attached to RoE and ATT&CK artifacts. No live campaign required — paperwork first. Next: Quiz — Emulation Planning.
1. Lab contract: write the plan pack
Create $HOME/cyberlium-lab/t21-m03-l04-plan-lab.txt merging intel summary, emulation plan outline, success criteria, and NEVER stranger lines.
Cross-reference RoE pack and ATT&CK pack paths from Module 1–2.
Command guide
Try these commands — Lab contract: write the plan pack
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: python3, curl, grep. Reference sites: Group pages (https://attack.mitre.org/groups/); Emulation plans (https://attack.mitre.org/resources/adversary-emulation-plans/); Atomic Red Team (https://redcanary.com/atomic-red-team/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check plan scope creep
Grep plan for production, classmate, or mass-email language — remove or redact to $LAB_RT lab steps. Tutorials showing full APT chains get trimmed to detection-relevant TTPs under RoE.
Classmates write their own plan packs for their $LAB_RT.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Initial Access Literacy.
Plan packs open purple debriefs; you are drafting campaign authorization early.
4. What you ship: emulation plan pack for $LAB_RT
Intel + plan outline + success criteria merged. $LAB_RT named. NEVER stranger phases. chmod 600.
5. What you record before the next lesson
Date. Plan pack path. $LAB_RT named. File t21-m03-l04-plan-lab.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Add phishing kit steps to plan pack. Skip file and run campaign on production.
Right
Write YOUR plan pack for $LAB_RT. chmod 600. Next: Quiz — Emulation Planning.
Mission: freeze YOUR plan pack on disk
1) Merge intel, plan, criteria sections. 2) Link RoE and ATT&CK pack paths. 3) chmod 600. Never list stranger attack phases.
Stuck? Ask Cyberlium AI Mentor
Plan packs prevent 'just one quick test' outside RoE.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Plan pack should reference RoE and ATT&CK artifacts.
True or False
Knowledge Check
APPLY: APT tutorial full chain on public victims. You:
Multiple choice