Red › Module 9 › Lesson 4
Lab — Report Draft
Assemble full red-team report from $LAB_RT — exec, ATT&CK map, remediation, purple evidence, debrief notes.
Visual · t21_report_lab
Lab: red-team report on $LAB_RT engagement. Original Cyberlium.
Opening
One complete report proves you can debrief defenders — not that you collected stranger breach trophies.
Build red-team report from Modules 6–8 artifacts: cover ($LAB_RT scope, RoE, dates), executive pulse, methodology and RoE adherence, ATT&CK mapping table, technical timeline redacted, purple detections summary, remediation table, debrief questions for stakeholders, appendix with evidence index and integrity statement (no unauthorized targets, no real PII, no cover-tracks). Export markdown or PDF chmod 600. Optional mentor review — three clarity questions. No stranger shells, no credential dump appendices, no anti-forensics.
1. Report skeleton
Cover → exec → scope/RoE → methodology → ATT&CK map → timeline → purple summary → remediation → debrief → appendix.
Cross-link persist, lateral, purple lab packs by ID.
Command guide
Try these commands — Report skeleton
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Report after evidence — https://attack.mitre.org/resources/adversary-emulation-plans/ Enterprise Matrix — https://attack.mitre.org/matrices/enterprise/ CISA — https://www.cisa.gov/resources-tools/resources/red-team-exercises
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
Built-in (iproute2)
macOS:
Command — copy this
brew install nmap
Use: netstat
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Use: netstat
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t21-rt/lab.env" 2>/dev/null || export LAB_HOST=${LAB_HOST:-127.0.0.1}
nmap -sn "$LAB_HOST" 2>/dev/null | grep -E 'Host is up|Nmap scan' | head -4
ss -tulpn 2>/dev/null | head -8
cat > "$HOME/cyberlium-lab/t21-rt/report-draft.txt" <<'EOF'
executive_summary: (after lab enum)
techniques_observed: Txxxx mapped from evidence
detections_triggered: (purple team results)
remediation: prioritize high-impact gaps
EOFCommand — copy this
grep -E 'executive|techniques|remediation' "$HOME/cyberlium-lab/t21-rt/report-draft.txt"
Primary tools to practice this lesson: grep, nmap, ss. Reference sites: Report after evidence (https://attack.mitre.org/resources/adversary-emulation-plans/); Enterprise Matrix (https://attack.mitre.org/matrices/enterprise/); CISA (https://www.cisa.gov/resources-tools/resources/red-team-exercises). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Debrief section
Questions for leadership: accepted gaps, funding priorities, next purple cycle.
Lessons learned — professional tone, no blame theater.
3. Teardown
chmod 600 report. Redact before wider share.
Revoke lab creds; confirm persistence teardown from Module 6.
4. What you ship: red-team report lab pack
Complete report + evidence index + integrity line — chmod 600.
5. What you record before the next lesson
Report lab path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Pad report with unauthorized pentest trophies and live hashes.
Right
Red-team report from $LAB_RT engagement. Next: quiz.
Mission: report lab
1) Exec pulse from purple outcomes. 2) ATT&CK map + remediation table. 3) Debrief questions + evidence index.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Debrief — top three stakeholder questions?”
Knowledge Check
APPLY: Report lab uses:
Multiple choice
Knowledge Check
APPLY: True or False: Live cred dumps in appendix OK.
True or False
Knowledge Check
APPLY: Report includes:
Multiple choice