Red › Module 1 › Lesson 2
RoE and Objectives
Rules of Engagement define scope, methods, and stop conditions — read and write RoE for YOUR $LAB_RT before any emulation step.
Visual · rt_roe_and_objectives
RoE + objectives literacy. $LAB_RT only. Original Cyberlium.
Opening
RoE is your authorization document. Objectives tell you when the campaign succeeds — both live inside it.
Rules of Engagement name authorized targets ($LAB_RT VMs), allowed techniques, forbidden actions, time windows, communication channels, and escalation contacts. Objectives state what the red team tries to achieve — crown jewel access, domain dominance in lab AD, or detection of specific TTPs — within those rules. Cyberlium teaches RoE literacy on labs YOU own at $LAB_RT. You do not copy a corporate RoE template and aim it at a school network or classmate project. Next: Lab-Only Infra.
1. RoE elements every red team expects
Scope: hostnames, IP ranges, accounts, and apps in $LAB_RT. Methods: allowed TTP categories, C2 constraints, phishing simulation boundaries. Forbidden: production touch, mass email, ransomware, data exfil beyond lab fixtures. Time: start/stop, maintenance blackouts.
Before any emulation on $LAB_RT, save RoE date, scope list, and forbidden actions. Stale RoE creates legal and ethical risk.
Command guide
Try these commands — RoE elements every red team expects
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Rules of Engagement — https://www.cisa.gov/resources-tools/resources/red-team-exercises (RoE before any lab action) MITRE ATT&CK — https://attack.mitre.org/ (map objectives to tactics)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t21-rt"
cat > "$HOME/cyberlium-lab/t21-rt/roe.txt" <<'EOF'
LAB_HOST=${LAB_HOST:-127.0.0.1}
LAB_RT=authorized purple-team lab only
never: stranger phishing, production C2, cred dumps outside lab
EOFCommand — copy this
grep -E 'LAB_|never' "$HOME/cyberlium-lab/t21-rt/roe.txt" curl -sS https://www.cisa.gov/resources-tools/resources/red-team-exercises | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: Rules of Engagement (https://www.cisa.gov/resources-tools/resources/red-team-exercises); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Objectives align red and blue
Objectives might include: achieve persistence on lab DC, simulate ransomware prep without deployment, or validate SOC detects T1059 within N minutes. Objectives must fit RoE — no objective justifies out-of-scope harm.
Purple teams write objectives defenders can measure: alert fired, ticket opened, containment within SLA. Steal that habit and leave stranger networks alone.
3. RoE is not a blank check
Signed lab RoE does not authorize testing unlisted subnets, third-party SaaS, employee personal accounts, or classmate VMs unless explicitly included. When in doubt, ask the engagement lead — do not 'just try.'
Ship: one-line RoE summary + two objectives for YOUR $LAB_RT. Next lesson covers lab-only infrastructure.
4. What you ship: RoE summary and objectives for $LAB_RT
Summarize RoE scope, forbidden actions, and two objectives. $LAB_RT named. NEVER production/classmates. chmod 600.
5. What you record before the next lesson
Date. RoE summary + objectives. $LAB_RT named. File t21-m01-l02-roe-and-objectives.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Assume instructor mention of 'red team' authorizes all campus networks. Skip forbidden list because 'it's just a lab.'
Right
Summarize RoE and objectives for YOUR $LAB_RT. Next: Lab-Only Infra.
Mission: draft RoE summary for YOUR lab
1) List scope, forbidden actions, and time window for $LAB_RT. 2) Write two measurable objectives. 3) Note RoE date. 4) chmod 600. Never test assets not listed in RoE.
Stuck? Ask Cyberlium AI Mentor
RoE protects operators and neighbors — scope violations void authorization instantly.
Knowledge Check
APPLY: RoE for $LAB_RT should name:
Multiple choice
Knowledge Check
APPLY: True or False: Objectives can justify techniques forbidden in RoE.
True or False
Knowledge Check
APPLY: Before emulation on $LAB_RT you should:
Multiple choice