Lab — ATT&CK

Pack ATT&CK map, technique hypothesis, and hunt query cards — ATT&CK hunting file from $HUNT_LAB only.

Lab — ATT&CK• Audio Walkthrough

00:00/02:58

Visual · t30_attack_lab

Lab: ATT&CK pack. $HUNT_LAB only. Original Cyberlium.

ATT&CK pack merges mapping to hypothesis to queries — paperwork before advanced SIEM module.

Lessons 3-1–3-3 named ATT&CK mapping, technique hypotheses, and hunt query patterns. This lab merges three cards with optional jq output from YOUR $HUNT_LAB auth jsonl. Optional: run jq count on failed auth in lab jsonl — log command and UTC only; no stranger cluster. Next: Quiz — ATT&CK Hunting.

1. Lab contract: ATT&CK pack

Create $HOME/cyberlium-lab/t30-m03-l04-attack-lab.txt merging ATT&CK map, technique hypothesis, and hunt query sections with $HUNT_LAB jsonl paths and M1 ethics cross-reference.

Optional: paste redacted jq one-liner output — no real usernames from production exports.

Command guide

Try these commands — Lab contract: ATT&CK pack

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

MITRE hunt — https://attack.mitre.org/ Sigma — https://sigmahq.io/ Elastic detection — https://www.elastic.co/guide/en/security/current/rules-ui.html

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install jq

macOS:

Command — copy this

brew install jq

Windows:

Command — copy this

choco install jq

═══ LINUX / macOS ═══

Command — copy this

export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/logs/netflow.jsonl" <<'EOF'
{"ts":"2026-08-22T04:11:30Z","src_ip":"10.0.5.20","dst_ip":"203.0.113.99","dst_port":443,"proto":"tcp","bytes_out":512,"bytes_in":128,"host":"WIN-HUNT01"}
{"ts":"2026-08-22T04:12:30Z","src_ip":"10.0.5.20","dst_ip":"203.0.113.99","dst_port":443,"proto":"tcp","bytes_out":498,"bytes_in":130,"host":"WIN-HUNT01"}
{"ts":"2026-08-22T04:13:30Z","src_ip":"10.0.5.20","dst_ip":"203.0.113.99","dst_port":443,"proto":"tcp","bytes_out":505,"bytes_in":125,"host":"WIN-HUNT01"}
{"ts":"2026-08-22T04:14:00Z","src_ip":"10.0.3.50","dst_ip":"10.0.3.10","dst_port":445,"proto":"tcp","bytes_out":4096,"bytes_in":8192,"host":"WIN-HUNT02"}
{"ts":"2026-08-22T04:15:00Z","src_ip":"10.0.3.50","dst_ip":"8.8.8.8","dst_port":53,"proto":"udp","bytes_out":64,"bytes_in":128,"host":"WIN-HUNT02"}
EOF

Command — copy this

echo '=== ATT&CK hunt lab: correlate auth + process + netflow ==='
jq -c 'select(.user=="jsmith")' "$HUNT_LAB/logs/auth.jsonl"
jq -c 'select(.user=="jsmith" and .process=="powershell.exe")' "$HUNT_LAB/logs/process.jsonl"
jq -c 'select(.dst_ip=="203.0.113.99")' "$HUNT_LAB/logs/netflow.jsonl"
grep LAB-HUNT "$HUNT_LAB/hunt/attack-map-lab.txt"

═══ WINDOWS ═══

Command — copy this

findstr jsmith $HOME/cyberlium-lab/t30-hunt/logs/auth.jsonl
findstr powershell $HOME/cyberlium-lab/t30-hunt/logs/process.jsonl

Primary tools to practice this lesson: jq, grep. Reference sites: MITRE hunt (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Elastic detection (https://www.elastic.co/guide/en/security/current/rules-ui.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Cross-check ethics

Grep for Splunk token, offensive playbook refs, production index names — remove. Pack must label all queries as $HUNT_LAB conceptual only.

Confirm lateral movement and credential dump references stay detection literacy — no how-to steps.

3. Lock the proof

chmod 600 on the pack. Quiz next — then SPL Literacy.

ATT&CK hunting literacy feeds advanced SIEM lessons in M4.

4. What you ship: ATT&CK hunting pack for $HUNT_LAB

Merged map, hypothesis, query sections. $HUNT_LAB named. NO stranger cluster. chmod 600.

5. What you record before the next lesson

Date. ATT&CK pack path. $HUNT_LAB named. File t30-m03-l04-attack-lab.txt chmod 600.

6. Wrong vs right: stranger prod vs YOUR hunt telemetry

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Include production Splunk index name in pack. Skip technique hypothesis section.
Right: Write YOUR ATT&CK hunting pack for $HUNT_LAB. chmod 600. Next: Quiz — ATT&CK Hunting.

Hands-on Exercise