Red › Module 3 › Lesson 3
Success Criteria
Success criteria define when emulation wins — detection, containment, or objective met on $LAB_RT within RoE.
Visual · rt_success_criteria
Success criteria literacy. $LAB_RT only. Original Cyberlium.
Opening
Red team 'success' might mean blue detected you in time — define that before you start.
Success criteria translate objectives into measurable outcomes on $LAB_RT: SOC alert within 15 minutes, containment before domain admin in lab, or validated detection for T1059. Some campaigns declare red success only if undetected — still bounded by RoE and lab isolation. Cyberlium teaches criteria literacy — not 'own everyone on the internet' goals. Next: Plan Lab.
1. Purple vs red success definitions
Purple success: technique emulated, detection fired or gap documented with remediation owner. Red success (stealth objective): objective met within RoE without triggering agreed controls — on $LAB_RT only.
Write both perspectives in notes so debrief does not argue undefined wins.
Command guide
Try these commands — Purple vs red success definitions
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Success criteria — https://attack.mitre.org/resources/adversary-emulation-plans/ (measurable purple outcomes) CISA exercises — https://www.cisa.gov/resources-tools/resources/red-team-exercises
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t21-rt/success-criteria.txt" <<'EOF' detection: blue team alerts on at least one mapped technique scope: all actions on LAB_HOST / LAB_RT only evidence: journalctl + ss captures saved never: exfil real PII, production C2 callbacks EOF
Command — copy this
grep -E 'detection|never' "$HOME/cyberlium-lab/t21-rt/success-criteria.txt" curl -sS https://attack.mitre.org/resources/adversary-emulation-plans/ | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: Success criteria (https://attack.mitre.org/resources/adversary-emulation-plans/); CISA exercises (https://www.cisa.gov/resources-tools/resources/red-team-exercises). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Measurable criteria examples
Time-bound: alert within N minutes of emulation step. Artifact-bound: specific log source records technique ID. Process-bound: ticket opened and assigned. Avoid vague 'get shell' without detection linkage on $LAB_RT.
Criteria must exclude harm metrics on production or classmates — lab fixtures only.
3. Stop conditions and failure handling
Stop if RoE boundary hit, unintended production touch detected, or blue calls pause. Snapshot revert plan is part of success hygiene on $LAB_RT.
Ship: three success criteria lines for YOUR $LAB_RT campaign. Next: Plan Lab.
4. What you ship: success criteria for $LAB_RT
Three measurable criteria + stop condition. Purple and red views. $LAB_RT only. chmod 600.
5. What you record before the next lesson
Date. Success criteria. $LAB_RT named. File t21-m03-l03-success-criteria.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Define success as ransomware on production. Skip stop conditions.
Right
Write success criteria for $LAB_RT. Next: Plan Lab.
Mission: define success criteria
1) Write three measurable criteria for $LAB_RT. 2) Add stop condition line. 3) Note purple vs red success view. 4) chmod 600. Never criteria that require stranger harm.
Stuck? Ask Cyberlium AI Mentor
Measurable criteria make debriefs factual — not subjective.
Knowledge Check
APPLY: Success criteria on Cyberlium should be:
Multiple choice
Knowledge Check
APPLY: True or False: Purple success can mean documenting a detection gap.
True or False
Knowledge Check
APPLY: Stop conditions should include:
Multiple choice