Threat › Module 3 › Lesson 4
Lab — IOCs
Pack IOC named, TTP named, and IOC vs TTP cards — IOC literacy file from $TI_LAB only.
Visual · t33_ioc_lab
Lab: IOC/TTP pack. $TI_LAB only. Original Cyberlium.
Opening
IOC pack merges types to TTPs to comparison — paperwork before ATT&CK structure module.
Lessons 3-1–3-3 named IOC types, TTP layers, and IOC vs TTP comparison. This lab merges three sections into one $TI_LAB IOC artifact with M1 ethics cross-reference. No live victim IOC imports — lab indicator paperwork only. Next: Quiz — IOC and TTP Literacy.
1. Lab contract: IOC and TTP pack
Create $HOME/cyberlium-lab/t33-m03-l04-ioc-lab.txt merging IOC named, TTP named, and IOC vs TTP sections with $TI_LAB fictional campaign and M1 ethics cross-reference.
Optional: one linked IOC-technique pair with confidence and expiration dates.
Command guide
Try these commands — Lab contract: IOC and TTP pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MISP attributes — https://www.misp-project.org/attributes.html STIX patterns — https://oasis-open.github.io/cti-documentation/stix/intro.html MITRE ATT&CK — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install jq
macOS:
Command — copy this
brew install python3 brew install jq
Windows: Download https://python.org/downloads/
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
cat > "$TI_LAB/iocs/iocs.json" <<'EOF'
{
"description": "FAKE lab IOCs only — example.com, RFC1918, EICAR label",
"indicators": [
{"type": "domain-name", "value": "phish-lab.example.com", "confidence": "low", "tags": ["lab-fake"]},
{"type": "ipv4-addr", "value": "192.168.99.50", "confidence": "medium", "tags": ["rfc1918-lab"]},
{"type": "file-hash-sha256", "value": "275a021bbfb6489e53d7413bf5b6824cb1a6016864130517876c174ed4711497", "label": "EICAR-TEST-FILE-NOT-MALWARE", "tags": ["eicar-lab"]},
{"type": "url", "value": "https://example.com/lab-c2-fake", "confidence": "low", "tags": ["lab-fake"]}
]
}
EOFCommand — copy this
cat > "$TI_LAB/iocs/iocs.csv" <<'EOF' type,value,confidence,tags domain-name,c2-fake.example.com,low,lab-fake ipv4-addr,10.0.0.99,medium,rfc1918-lab file-hash-sha256,275a021bbfb6489e53d7413bf5b6824cb1a6016864130517876c174ed4711497,high,eicar-lab email-addr,[email protected],low,lab-fake EOF
Command — copy this
python3 - <<'PY'
import json, csv, os, re
lab = os.environ.get('TI_LAB', os.path.expanduser('~/cyberlium-lab/t33-ti'))
data = json.load(open(os.path.join(lab, 'iocs', 'iocs.json')))
ipv4 = re.compile(r'^((10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)|127\.)')
for i in data['indicators']:
v = i['value']
ok = 'example.com' in v or ipv4.match(v) or i.get('label','').startswith('EICAR')
print(f" {i['type']}: {v[:40]} -> {'OK lab-safe' if ok else 'REVIEW'}")
with open(os.path.join(lab, 'iocs', 'iocs.csv')) as f:
print(f'CSV rows: {sum(1 for _ in csv.DictReader(f))}')
PYCommand — copy this
command -v jq >/dev/null && jq '.indicators | length' "$TI_LAB/iocs/iocs.json" || grep -c domain-name "$TI_LAB/iocs/iocs.csv"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t33-ti/iocs/iocs.csv | Select-String example.com python -c "import json; d=json.load(open(r'$HOME/cyberlium-lab/t33-ti/iocs/iocs.json')); print(len(d['indicators']), 'fake IOCs')"
Primary tools to practice this lesson: python3, jq. Reference sites: MISP attributes (https://www.misp-project.org/attributes.html); STIX patterns (https://oasis-open.github.io/cti-documentation/stix/intro.html); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for live breach dumps, criminal marketplace IOC refs, real victim domains — remove. Confirm all indicators are lab-authored with fictional labels.
No publishable live adversary indicator lists.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Matrix Structure.
IOC literacy feeds ATT&CK structure lessons in M4.
4. What you ship: IOC and TTP pack for $TI_LAB
Merged IOC, TTP, comparison sections. $TI_LAB named. NO live victim dumps. chmod 600.
5. What you record before the next lesson
Date. IOC pack path. $TI_LAB named. File t33-m03-l04-ioc-lab.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include live ransomware C2 list in pack. Skip TTP section.
Right
Write YOUR IOC and TTP pack for $TI_LAB. chmod 600. Next: Quiz — IOC and TTP Literacy.
Mission: freeze YOUR IOC pack on disk
1) Merge M3 literacy sections. 2) Confirm all IOCs are lab-authored. 3) Link M1 ethics cross-ref. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One governed IOC pack beats ten unauthorized breach dump imports.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: IOC pack must use fictional lab labels on all indicators.
True or False
Knowledge Check
APPLY: IOC pack supports:
Multiple choice