Red › Module 6 › Lesson 4
Lab — Persist Enum
Document persistence and LOLBin literacy on $LAB_RT — detection map per brief, teardown mandatory, no stranger implants.
Visual · t21_persist_lab
Lab: persistence/LOLBin literacy on $LAB_RT. Original Cyberlium.
Opening
One lab host, two technique classes, detection rows for blue — not a persistence campaign on infrastructure you never joined.
On YOUR $LAB_RT host per written RoE: (1) pick two persistence or LOLBin technique classes allowed in brief; (2) for each, write ATT&CK ID, emulation objective, expected defender log source, and teardown step (delete task, revert snapshot, remove service); (3) if brief permits brief lab action, perform minimal RoE-bounded step and capture redacted telemetry screenshot — stop at proof; (4) refuse log clearing or persistence outside teardown window. chmod 600 notes in $HOME/cyberlium-lab. No implants on stranger AD, no autostart on daily-driver OS, no anti-forensics.
1. Lab setup
Verify hostname is in $LAB_RT RoE document before any action.
Confirm teardown method and time box with operator/mentor — persistence without teardown plan is refused.
Command guide
Try these commands — Lab setup
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Scheduled tasks — https://attack.mitre.org/techniques/T1053/ (persistence literacy) LOLBAS — https://lolbas-project.github.io/ (lolbin names for detection mapping)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
crontab -l 2>/dev/null | head -8 || echo 'no user crontab' systemctl list-timers --no-pager 2>/dev/null | head -12 || systemctl list-units --type=timer --no-pager 2>/dev/null | head -8 cat > "$HOME/cyberlium-lab/t21-rt/persistence-notes.txt" <<'EOF' enum: crontab -l, systemctl list-timers (YOUR lab only) mapped: T1053 scheduled task / cron (literacy) never: persist on stranger systems EOF
Command — copy this
grep -E 'enum|never' "$HOME/cyberlium-lab/t21-rt/persistence-notes.txt"
Primary tools to practice this lesson: crontab, systemctl, grep. Reference sites: Scheduled tasks (https://attack.mitre.org/techniques/T1053/); LOLBAS (https://lolbas-project.github.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Deliverables
Two technique cards: class, ATT&CK ID, detection hypothesis, teardown command or snapshot step.
Purple note: what rule would you give blue after this lab?
3. Stop conditions
Stop at minimal proof or literacy-only per brief — no multi-host persistence, no cover-tracks.
If host not in RoE, document blocker — do not 'just try' classmate VLAN.
4. What you ship: persist lab pack
Two technique/detection cards + teardown proof + NO anti-forensics line — chmod 600.
5. What you record before the next lesson
Persist lab notes path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Leave autostart persistence on lab host after course with no teardown.
Right
Persist lab pack with teardown on $LAB_RT. Next: quiz.
Mission: persist lab
1) Pick two in-RoE technique classes. 2) Write detection row per class. 3) Execute teardown or snapshot revert. 4) Secure notes chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Literacy-only vs brief lab action — which for me?”
Knowledge Check
APPLY: Persist lab target:
Multiple choice
Knowledge Check
APPLY: True or False: Skip teardown to 'simulate real APT.'
True or False
Knowledge Check
APPLY: Persist lab pack includes:
Multiple choice