Red › Module 3 › Lesson 4
Lab — Plan Draft
Pack emulation plan — intel inputs, plan outline, success criteria — literacy file only, dest $LAB_RT.
Visual · rt_plan_lab
Lab: write plan pack. $LAB_RT only. Original Cyberlium.
Opening
Plan pack before campaign — intel, sequence, criteria on paper first.
Lessons 3-1 through 3-3 covered intel inputs, emulation plan structure, and success criteria. This lab merges them into one plan pack for $LAB_RT attached to RoE and ATT&CK artifacts. No live campaign required — paperwork first. Next: Quiz — Emulation Planning.
1. Lab contract: write the plan pack
Create $HOME/cyberlium-lab/t21-m03-l04-plan-lab.txt merging intel summary, emulation plan outline, success criteria, and NEVER stranger lines.
Cross-reference RoE pack and ATT&CK pack paths from Module 1–2.
Command guide
Try these commands — Lab contract: write the plan pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Group pages — https://attack.mitre.org/groups/ (technique list for plan) Emulation plans — https://attack.mitre.org/resources/adversary-emulation-plans/ Atomic Red Team — https://redcanary.com/atomic-red-team/ (optional lab test mapping)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t21-rt/lab.env" 2>/dev/null || true
python3 <<'PY' > "$HOME/cyberlium-lab/t21-rt/emulation-plan.txt"
print('emulation_plan: lab-only')
print('target: LAB_HOST')
print('phases: initial_access -> execution -> persistence (literacy)')
print('never: weapon kits, stranger phishing')
PYCommand — copy this
curl -sS https://attack.mitre.org/groups/G0050/ | grep -oE 'T[0-9]{4}(\.[0-9]{3})?' | sort -u | head -10
grep -E 'target|never' "$HOME/cyberlium-lab/t21-rt/emulation-plan.txt"Primary tools to practice this lesson: python3, curl, grep. Reference sites: Group pages (https://attack.mitre.org/groups/); Emulation plans (https://attack.mitre.org/resources/adversary-emulation-plans/); Atomic Red Team (https://redcanary.com/atomic-red-team/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check plan scope creep
Grep plan for production, classmate, or mass-email language — remove or redact to $LAB_RT lab steps. Tutorials showing full APT chains get trimmed to detection-relevant TTPs under RoE.
Classmates write their own plan packs for their $LAB_RT.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Initial Access Literacy.
Plan packs open purple debriefs; you are drafting campaign authorization early.
4. What you ship: emulation plan pack for $LAB_RT
Intel + plan outline + success criteria merged. $LAB_RT named. NEVER stranger phases. chmod 600.
5. What you record before the next lesson
Date. Plan pack path. $LAB_RT named. File t21-m03-l04-plan-lab.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Add phishing kit steps to plan pack. Skip file and run campaign on production.
Right
Write YOUR plan pack for $LAB_RT. chmod 600. Next: Quiz — Emulation Planning.
Mission: freeze YOUR plan pack on disk
1) Merge intel, plan, criteria sections. 2) Link RoE and ATT&CK pack paths. 3) chmod 600. Never list stranger attack phases.
Stuck? Ask Cyberlium AI Mentor
Plan packs prevent 'just one quick test' outside RoE.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Plan pack should reference RoE and ATT&CK artifacts.
True or False
Knowledge Check
APPLY: APT tutorial full chain on public victims. You:
Multiple choice