Success Criteria
Success criteria define when emulation wins — detection, containment, or objective met on $LAB_RT within RoE.
Visual · rt_success_criteria
Success criteria literacy. $LAB_RT only. Original Cyberlium.
Red team 'success' might mean blue detected you in time — define that before you start.
Success criteria translate objectives into measurable outcomes on $LAB_RT: SOC alert within 15 minutes, containment before domain admin in lab, or validated detection for T1059. Some campaigns declare red success only if undetected — still bounded by RoE and lab isolation. Cyberlium teaches criteria literacy — not 'own everyone on the internet' goals. Next: Plan Lab.
1. Purple vs red success definitions
Purple success: technique emulated, detection fired or gap documented with remediation owner. Red success (stealth objective): objective met within RoE without triggering agreed controls — on $LAB_RT only.
Write both perspectives in notes so debrief does not argue undefined wins.
Command guide
Try these commands — Purple vs red success definitions
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: Success criteria (https://attack.mitre.org/resources/adversary-emulation-plans/); CISA exercises (https://www.cisa.gov/resources-tools/resources/red-team-exercises). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Measurable criteria examples
Time-bound: alert within N minutes of emulation step. Artifact-bound: specific log source records technique ID. Process-bound: ticket opened and assigned. Avoid vague 'get shell' without detection linkage on $LAB_RT.
Criteria must exclude harm metrics on production or classmates — lab fixtures only.
3. Stop conditions and failure handling
Stop if RoE boundary hit, unintended production touch detected, or blue calls pause. Snapshot revert plan is part of success hygiene on $LAB_RT.
Ship: three success criteria lines for YOUR $LAB_RT campaign. Next: Plan Lab.
4. What you ship: success criteria for $LAB_RT
Three measurable criteria + stop condition. Purple and red views. $LAB_RT only. chmod 600.
5. What you record before the next lesson
Date. Success criteria. $LAB_RT named. File t21-m03-l03-success-criteria.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Define success as ransomware on production. Skip stop conditions.
- Right: Write success criteria for $LAB_RT. Next: Plan Lab.
Mission: define success criteria
1) Write three measurable criteria for $LAB_RT. 2) Add stop condition line. 3) Note purple vs red success view. 4) chmod 600. Never criteria that require stranger harm.
Stuck? Ask Cyberlium AI Mentor
Measurable criteria make debriefs factual — not subjective.
APPLY: Success criteria on Cyberlium should be:
APPLY: True or False: Purple success can mean documenting a detection gap.
APPLY: Stop conditions should include: