SOC › Module 1 › Lesson 3
No Offensive Playbooks
No offensive playbooks means refuse lateral movement, credential dumping, and exploit how-to — write the refusal habit into YOUR $HUNT_LAB ethics card.
Visual · t30_no_offensive_playbooks
Offensive refusal. $HUNT_LAB only. Original Cyberlium.
Opening
Forum exploit chains, Mimikatz tutorials, and pass-the-hash cookbooks — all stop outside authorized defensive scope. Literacy names the technique; hunts stay on lab telemetry.
Offensive playbooks include step-by-step lateral movement guides, credential dumping walkthroughs, exploit deployment scripts, and live attack emulation against systems you do not own. Org scope follows ownership: finance, health, and SaaS telemetry without ticket stay off limits. Cyberlium practices refusal sentences on YOUR $HUNT_LAB — 'I hunt only sample telemetry and name techniques for detection context' — never copy forum threads that aim exploit tooling at live services. Next: Lab Setup.
1. Offensive patterns refused (named, literacy only)
Lateral movement cookbooks: step-by-step guides to pivot through live networks — named for ATT&CK literacy, NOT executed on Cyberlium. Credential dumping how-to: tooling walkthroughs against live domains — defender fix is detection and hardening, not student replication.
On $HUNT_LAB, write three refusal triggers — e.g., exploit script request, credential dump tutorial, live lateral movement against stranger hosts.
Command guide
Try these commands — Offensive patterns refused (named, literacy only)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE ATT&CK — https://attack.mitre.org/ (detection-only mindset) SANS — https://www.sans.org/ (defensive IR literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/hunt/no-offensive-playbooks.txt" <<'EOF'
SCOPE: YOUR lab folder $HOME/cyberlium-lab/t30-hunt/ — FAKE seeded telemetry only
NEVER: Impacket/Mimikatz/Cobalt Strike recipes, malware payloads, live isolation of stranger machines
NEVER: offensive lateral-movement cookbooks against unauthorized targets
ALLOWED: jq/python3 hunt queries on YOUR process/netflow/auth/alerts JSONL, curl public docs
PURPOSE: SOC L2/L3 detection, correlation, IR literacy — hunt hypotheses on FAKE data
EOFCommand — copy this
grep -E 'SCOPE|NEVER|ALLOWED' "$HUNT_LAB/hunt/no-offensive-playbooks.txt"
python3 -c "print('Ethics: offensive playbooks on live targets = legal risk — YOUR lab telemetry only')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE ATT&CK (https://attack.mitre.org/); SANS (https://www.sans.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why refusal protects you and others
Unauthorized access laws and employer policy apply to offensive tooling — skill without scope is career and legal risk. Victim data: production telemetry contains PII, credentials, and session tokens you must not exfiltrate.
Defenders detect and contain these techniques — students practice naming them for hunt hypotheses on lab scenarios and defender notes only.
3. Ethics card habit
Forbidden: running credential dump tools on live AD, sharing exploit chains in class chat, importing victim PCAP without scope. Allowed: ethics card — allowed telemetry samples, NEVER list, refusal sentence you will say aloud.
Ship: hunt ethics card with NEVER list and one refusal sentence. Next: Lab Setup.
4. What you ship: hunt ethics card for $HUNT_LAB
Allowed telemetry, NEVER list, refusal sentence. $HUNT_LAB named. NO offensive playbooks. chmod 600.
5. What you record before the next lesson
Date. Ethics card. $HUNT_LAB named. File t30-m01-l03-no-offensive-playbooks.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Follow Mimikatz tutorial on employer domain 'for detection.' Share exploit chain in Discord.
Right
Write hunt ethics card for YOUR $HUNT_LAB. Next: Lab Setup.
Mission: write YOUR offensive refusal habit
1) List three NEVER targets (lateral movement how-to, credential dumping, live exploit scripts). 2) Write one refusal sentence for offensive playbook requests. 3) Name allowed $HUNT_LAB surfaces. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Name techniques for detection — never replicate attacks on systems you do not own.
Knowledge Check
APPLY: No offensive playbooks on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: ATT&CK techniques are taught as named risk classes with defender notes — not as live attack cookbooks.
True or False
Knowledge Check
APPLY: Discord link to credential dump tutorial for live domain — you:
Multiple choice