Lab — Capstone

Execute capstone on $HUNT_LAB — checklist, lab path, evidence pack sealed; zero unauthorized access.

Lab — Capstone• Audio Walkthrough

00:00/03:01

Visual · t30_capstone_lab

Capstone: checklist × $HUNT_LAB literacy evidence. Original Cyberlium.

Close the SOC Level 2 & 3 literacy loop — hunt shipped, IR documented, handoff ready, RoE signed — without unauthorized prod response or offensive playbooks.

Walk Topic 30 checklist on YOUR $HUNT_LAB: verify RoE, lab path current, hunt and IR labs complete, containment and eradication packs indexed, PIR lab sealed, scan for offensive playbooks and prod paste (must be zero). Update index with capstone UTC completion. Integrity paragraph: hunt discipline and containment decision literacy key insight from YOUR path. No unauthorized prod hunt/IR, no lateral movement or malware cookbooks, no prod containment without RoE, no validation fraud. Optional mentor review — three clarity questions. Archive lab telemetry after if brief requires.

1. Execute checklist

Check each row; link artifact or N/A; confirm zero refused techniques in any file.

Scan sealed pack for offensive scripts and prod paste — remove before handoff.

Command guide

Try these commands — Execute checklist

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

SOC L2/L3 capstone — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE ATT&CK — https://attack.mitre.org/ Sigma — https://sigmahq.io/ SANS IR — https://www.sans.org/white-papers/incident-handlers-handbook/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install jq
sudo apt install python3

macOS:

Command — copy this

brew install jq
brew install python3

Windows:

Command — copy this

choco install jq

Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
grep NEVER "$HUNT_LAB/hunt/no-offensive-playbooks.txt"
grep 'HARD BAN' "$HUNT_LAB/ir/containment-options.txt"
echo '=== Capstone: seed → hunt → correlate → IR → PIR ==='
jq '.[] | select(.scenario=="LAB-IR-001") | .id' "$HUNT_LAB/logs/alerts.json"
jq -c 'select(.parent=="winword.exe" and .process=="powershell.exe")' "$HUNT_LAB/logs/process.jsonl"
python3 - <<'PY'
import json, os
lab = os.environ.get('HUNT_LAB', os.path.expanduser('~/cyberlium-lab/t30-hunt'))
auth = [json.loads(l) for l in open(os.path.join(lab,'logs','auth.jsonl'))]
jsmith = [e for e in auth if e['user']=='jsmith']
fails = sum(1 for e in jsmith if e['result']=='failure')
succ = sum(1 for e in jsmith if e['result']=='success')
print(f'Failed-then-success: {fails} fail → {succ} success (jsmith)')
PY

Command — copy this

grep -E 'PICERL|Containment|LAB-IR' "$HUNT_LAB/ir/picerl-checklist.md"
grep -E 'Gap|Action items' "$HUNT_LAB/pir/pir-template-LAB-IR-001.md"
python3 - <<'PY'
import os
lab = os.environ.get('HUNT_LAB', os.path.expanduser('~/cyberlium-lab/t30-hunt'))
path = os.path.join(lab, 'hunt', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
  'SOC Level 2 & 3 Defensive Capstone',
  'scope: YOUR $HOME/cyberlium-lab/t30-hunt/ only',
  'seed: process.jsonl + netflow.jsonl + auth.jsonl + alerts.json (FAKE)',
  'hunt: rare parent winword→powershell + failed-then-success logon',
  'siem: SPL/KQL literacy + jq bridge on YOUR JSONL',
  'correlate: LAB-IR-001 chain HNT-001/002/003',
  'ir: PICERL + containment decision tree (LAB IDs only)',
  'pir: template + detection gaps + L3 handoff',
  'never: Impacket/Mimikatz/Cobalt / stranger isolation / malware payloads',
]))
print(f'Wrote {path}')
PY

Command — copy this

grep -E 'scope|never|hunt' "$HUNT_LAB/hunt/capstone-summary.txt"

═══ WINDOWS ═══

Capstone on YOUR lab Windows VM only

Command — copy this

Get-Content $HOME/cyberlium-lab/t30-hunt/hunt/no-offensive-playbooks.txt | Select-String NEVER
Get-Content $HOME/cyberlium-lab/t30-hunt/hunt/capstone-summary.txt | Select-String never
findstr HNT-002 $HOME/cyberlium-lab/t30-hunt/logs/alerts.json

Primary tools to practice this lesson: grep, jq, python3. Reference sites: SOC L2/L3 capstone (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); SANS IR (https://www.sans.org/white-papers/incident-handlers-handbook/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.