Threat › Module 1 › Lesson 2
Lab IOCs Only
Lab IOCs only means YOUR fictional indicators under $TI_LAB — RFC5737 IPs, example.local domains, and labeled sample hashes — document IOC scope in notes before any enrichment drill.
Visual · t33_lab_iocs_only
Lab IOC scope. $TI_LAB only. Original Cyberlium.
Opening
The indicator owner is part of scope — Cyberlium refuses enrichment drills on live victim IOCs or criminal marketplace dumps you do not have authorization to handle.
Your TI lab IOCs are fictional samples YOU authored — 203.0.113.45 style TEST-NET addresses, evil-lab.example.local domains, and clearly labeled sample hashes like LAB-SHA256-001. Enrichment drills live in $TI_LAB only — never copied from live breach dumps or criminal forum posts. Cyberlium maps allowed IOC inventory on YOUR $TI_LAB — indicator value, type, fictional label — never 'borrowed' employer production feeds or scraped criminal marketplace lists. Next: No Criminal Markets.
1. Allowed lab IOC surfaces (named)
RFC5737 documentation IPs such as 203.0.113.45. example.local or lab-malware.example domains. Clearly labeled sample hashes prefixed LAB- or CYBERLIUM-. Courseware TI packs with explicit training labels and fictional actor names.
On $TI_LAB, list indicator type, value, and fictional label — never paste live victim IOCs from public breach dumps.
Command guide
Try these commands — Allowed lab IOC surfaces (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ MISP project — https://www.misp-project.org/ (sharing platform literacy) OpenCTI — https://docs.opencti.io/latest/ (TI platform concepts)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t33-ti/notes" "$HOME/cyberlium-lab/t33-ti/iocs" "$HOME/cyberlium-lab/t33-ti/attack" "$HOME/cyberlium-lab/t33-ti/feeds" "$HOME/cyberlium-lab/t33-ti/platforms" "$HOME/cyberlium-lab/t33-ti/collection" "$HOME/cyberlium-lab/t33-ti/reports" "$HOME/cyberlium-lab/t33-ti/stix" cat > "$HOME/cyberlium-lab/t33-ti/lab.env" <<'EOF' export TI_LAB=$HOME/cyberlium-lab/t33-ti export TI_LAB_IOCS=$HOME/cyberlium-lab/t33-ti/iocs export TI_LAB_ATTACK=$HOME/cyberlium-lab/t33-ti/attack export TI_LAB_FEEDS=$HOME/cyberlium-lab/t33-ti/feeds export TI_LAB_REPORTS=$HOME/cyberlium-lab/t33-ti/reports EOF
Command — copy this
chmod 600 "$HOME/cyberlium-lab/t33-ti/lab.env" grep -E 'TI_LAB' "$HOME/cyberlium-lab/t33-ti/lab.env" curl -sS https://www.misp-project.org/ | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); MISP project (https://www.misp-project.org/); OpenCTI (https://docs.opencti.io/latest/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why lab IOC scope matters before enrichment
TI platforms, sandboxes, and enrichment APIs are powerful on any indicator — scope is what keeps practice legal and ethical. Employer production feeds, live breach dumps, and criminal marketplace IOC lists are out of scope.
If you cannot answer 'who authored this IOC and is it labeled lab-only?', pause and fix scope notes before running enrichment queries.
3. Lab IOC inventory habit
Forbidden: importing live ransomware C2 lists from criminal forums because they 'look like training.' Allowed: IOC inventory row — type, value, fictional label, source = $TI_LAB self-authored.
Ship: lab IOC inventory row for three fictional indicators. Next: No Criminal Markets.
4. What you ship: lab IOC inventory row for $TI_LAB
Three fictional IOCs with type and label. $TI_LAB named. NEVER live victim dumps. chmod 600.
5. What you record before the next lesson
Date. Lab IOC inventory row. $TI_LAB named. File t33-m01-l02-lab-iocs-only.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import live breach IOC dump because lab samples are boring. Skip IOC label because 'it's just a hash.'
Right
Write lab IOC inventory row for YOUR $TI_LAB. Next: No Criminal Markets.
Mission: document YOUR lab IOC inventory
1) Write three fictional IOCs (IP, domain, hash). 2) Label each as lab-only with fictional actor name. 3) Confirm zero live victim indicators. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
RFC5737 TEST-NET IPs exist for documentation — use them instead of live victim addresses.
Knowledge Check
APPLY: Lab IOCs only on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: 203.0.113.45 is an acceptable lab IP for TI drills.
True or False
Knowledge Check
APPLY: Before running enrichment drills you should:
Multiple choice