Red › Module 4 › Lesson 1
Access Vectors Named
Initial access vectors are named for ATT&CK literacy — understand categories for $LAB_RT planning, not stranger exploitation.
Visual · rt_access_vectors_named
Access vectors named literacy. $LAB_RT only. Original Cyberlium.
Opening
Initial Access is a tactic column — knowing vector names helps blue detect, not phish strangers.
Common initial access vectors include Phishing (T1566), Valid Accounts (T1078), External Remote Services (T1133), and Supply Chain (T1195) — named in ATT&CK for shared vocabulary. Red teams emulate selected vectors in $LAB_RT under RoE; defenders map controls and detections to the same names. Cyberlium teaches vector literacy — not operational guides for phishing kits, credential stuffing on strangers, or exploiting classmates. Next: Phishing Defender View.
1. Vector categories defenders prioritize
Email gateways, MFA, VPN posture, and software supply chain controls align to initial access vectors. Literacy means listing which vectors your $LAB_RT lab can simulate safely — e.g., planted malicious attachment in lab mailbox fixture, not mass email to real users.
Each vector row: ATT&CK ID, lab-safe emulation note, primary detection control, $LAB_RT asset.
Command guide
Try these commands — Vector categories defenders prioritize
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Initial Access tactics — https://attack.mitre.org/tactics/TA0001/ (named vectors only) MITRE ATT&CK — https://attack.mitre.org/ (technique literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://attack.mitre.org/tactics/TA0001/ | grep -oE 'T[0-9]{4}' | sort -u | head -8
source "$HOME/cyberlium-lab/t21-rt/lab.env" 2>/dev/null || export LAB_HOST=${LAB_HOST:-127.0.0.1}
nmap -sn "$LAB_HOST" 2>/dev/null | grep -E 'Host is up|Nmap scan' | head -4Primary tools to practice this lesson: curl, nmap. Reference sites: Initial Access tactics (https://attack.mitre.org/tactics/TA0001/); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Lab-safe vs never-emulate boundaries
Lab-safe on $LAB_RT: pre-seeded spearphish to lab user account with blue notified, valid test account login per RoE. Never: stranger phishing, purchased kits, credential spray on café Wi-Fi, classmate account targeting.
Naming vectors without RoE authorization is taxonomy homework — not attack permission.
3. Vectors feed emulation plan rows
Module 3 plan picks one initial access vector for $LAB_RT campaign — this lesson supplies vocabulary. Debrief maps vector to detection outcome.
Ship: table — three vectors, ATT&CK ID, lab-safe Y/N for $LAB_RT. Next: Phishing Defender View.
4. What you ship: access vector table for $LAB_RT
Three vectors with ATT&CK IDs and lab-safe flags. $LAB_RT only. NEVER stranger exploitation. chmod 600.
5. What you record before the next lesson
Date. Access vector table. $LAB_RT named. File t21-m04-l01-access-vectors-named.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
List 'phishing classmates' as lab vector. Buy phishing kit for homework.
Right
Write access vector table with lab-safe boundaries for $LAB_RT. Next: Phishing Defender View.
Mission: name access vectors for YOUR lab
1) List three initial access vectors with ATT&CK IDs. 2) Mark lab-safe on $LAB_RT per RoE. 3) Write NEVER stranger phishing line. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Vector names help blue — misuse helps attackers.
Knowledge Check
APPLY: Initial access vector literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: T1566 Phishing authorizes mass email to strangers.
True or False
Knowledge Check
APPLY: Lab-safe initial access on $LAB_RT might include:
Multiple choice