SOC › Module 10 › Lesson 4
Lab — Capstone
Execute capstone on $HUNT_LAB — checklist, lab path, evidence pack sealed; zero unauthorized access.
Visual · t30_capstone_lab
Capstone: checklist × $HUNT_LAB literacy evidence. Original Cyberlium.
Opening
Close the SOC Level 2 & 3 literacy loop — hunt shipped, IR documented, handoff ready, RoE signed — without unauthorized prod response or offensive playbooks.
Walk Topic 30 checklist on YOUR $HUNT_LAB: verify RoE, lab path current, hunt and IR labs complete, containment and eradication packs indexed, PIR lab sealed, scan for offensive playbooks and prod paste (must be zero). Update index with capstone UTC completion. Integrity paragraph: hunt discipline and containment decision literacy key insight from YOUR path. No unauthorized prod hunt/IR, no lateral movement or malware cookbooks, no prod containment without RoE, no validation fraud. Optional mentor review — three clarity questions. Archive lab telemetry after if brief requires.
1. Execute checklist
Check each row; link artifact or N/A; confirm zero refused techniques in any file.
Scan sealed pack for offensive scripts and prod paste — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
SOC L2/L3 capstone — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE ATT&CK — https://attack.mitre.org/ Sigma — https://sigmahq.io/ SANS IR — https://www.sans.org/white-papers/incident-handlers-handbook/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install python3
macOS:
Command — copy this
brew install jq brew install python3
Windows:
Command — copy this
choco install jq
Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
grep NEVER "$HUNT_LAB/hunt/no-offensive-playbooks.txt"
grep 'HARD BAN' "$HUNT_LAB/ir/containment-options.txt"
echo '=== Capstone: seed → hunt → correlate → IR → PIR ==='
jq '.[] | select(.scenario=="LAB-IR-001") | .id' "$HUNT_LAB/logs/alerts.json"
jq -c 'select(.parent=="winword.exe" and .process=="powershell.exe")' "$HUNT_LAB/logs/process.jsonl"
python3 - <<'PY'
import json, os
lab = os.environ.get('HUNT_LAB', os.path.expanduser('~/cyberlium-lab/t30-hunt'))
auth = [json.loads(l) for l in open(os.path.join(lab,'logs','auth.jsonl'))]
jsmith = [e for e in auth if e['user']=='jsmith']
fails = sum(1 for e in jsmith if e['result']=='failure')
succ = sum(1 for e in jsmith if e['result']=='success')
print(f'Failed-then-success: {fails} fail → {succ} success (jsmith)')
PYCommand — copy this
grep -E 'PICERL|Containment|LAB-IR' "$HUNT_LAB/ir/picerl-checklist.md"
grep -E 'Gap|Action items' "$HUNT_LAB/pir/pir-template-LAB-IR-001.md"
python3 - <<'PY'
import os
lab = os.environ.get('HUNT_LAB', os.path.expanduser('~/cyberlium-lab/t30-hunt'))
path = os.path.join(lab, 'hunt', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
'SOC Level 2 & 3 Defensive Capstone',
'scope: YOUR $HOME/cyberlium-lab/t30-hunt/ only',
'seed: process.jsonl + netflow.jsonl + auth.jsonl + alerts.json (FAKE)',
'hunt: rare parent winword→powershell + failed-then-success logon',
'siem: SPL/KQL literacy + jq bridge on YOUR JSONL',
'correlate: LAB-IR-001 chain HNT-001/002/003',
'ir: PICERL + containment decision tree (LAB IDs only)',
'pir: template + detection gaps + L3 handoff',
'never: Impacket/Mimikatz/Cobalt / stranger isolation / malware payloads',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'scope|never|hunt' "$HUNT_LAB/hunt/capstone-summary.txt"
═══ WINDOWS ═══
Capstone on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t30-hunt/hunt/no-offensive-playbooks.txt | Select-String NEVER Get-Content $HOME/cyberlium-lab/t30-hunt/hunt/capstone-summary.txt | Select-String never findstr HNT-002 $HOME/cyberlium-lab/t30-hunt/logs/alerts.json
Primary tools to practice this lesson: grep, jq, python3. Reference sites: SOC L2/L3 capstone (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); SANS IR (https://www.sans.org/white-papers/incident-handlers-handbook/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Integrity paragraph
RoE + hunt/IR discipline key → professional handoff idea from YOUR lab path.
Name what breaks if you skip scope or run unauthorized attacks — ethics tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 31 Cloud Security on separate authorized track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + integrity paragraph + zero refused scan.
5. What you record before the next lesson
Capstone pack path. $HUNT_LAB quiet.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone includes lateral movement walkthrough as bonus exhibit.
Right
Capstone complete on $HUNT_LAB with full teardown. Next: topic quiz.
Mission: Topic 30 capstone
1) Walk checklist with evidence links. 2) Integrity paragraph from your path. 3) Seal pack — zero refused files. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Offensive playbooks earn capstone credit.
True or False
Knowledge Check
APPLY: Capstone teardown includes:
Multiple choice