Threat › Module 1 › Lesson 4
Lab — Setup
Pack TI scope, lab IOC inventory, and ethics card — lab setup file only, dest $TI_LAB.
Visual · t33_lab_setup
Lab: write TI setup pack. $TI_LAB only. Original Cyberlium.
Opening
Lab setup before enrichment drills — scope paperwork TI mentors expect.
Lessons 1–3 defined why TI matters, lab IOCs only, and criminal-market refusal. This lab ships the combined artifact: topic scope paragraph, lab IOC inventory row, and ethics card for $TI_LAB under $HOME/cyberlium-lab/t33-ti/. No criminal marketplace access required — scope and lab IOC paperwork first. Next: Quiz — TI Mindset and Lab.
1. Lab contract: write the setup pack
Create $HOME/cyberlium-lab/t33-m01-l04-lab-setup.txt with date, operator, $TI_LAB placeholder, literacy vs unauthorized collection paragraph, lab IOC inventory row, and ethics card.
Optional: one-line proof your t33-ti folder exists — still no criminal marketplace work required in this lab.
Command guide
Try these commands — Lab contract: write the setup pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ OASIS STIX — https://oasis-open.github.io/cti-documentation/stix/intro.html MISP — https://www.misp-project.org/documentation/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
cat > "$TI_LAB/roe.txt" <<'EOF'
TI_LAB=$HOME/cyberlium-lab/t33-ti
targets: YOUR fake IOC files, YOUR ATT&CK mapping notes, YOUR TI report templates
never: buying access, carding forums, hacking forums howto, doxxing
never: tor marketplace steps; scrape real victim data; probe stranger infrastructure
allowed: iocs.json/csv with example.com/RFC1918/EICAR labels; curl public TI docs
allowed: python3/jq IOC validation; STIX-like JSON stubs; feed quality checklists
output: ATT&CK markdown maps, TI reports, collection policy notes in lab folder
EOFCommand — copy this
chmod 600 "$TI_LAB/roe.txt" grep -E 'TI_LAB|never|allowed|YOUR' "$TI_LAB/roe.txt" command -v python3 >/dev/null && python3 --version || echo 'python3 required for IOC validation lab' command -v jq >/dev/null && jq --version || echo 'jq optional — install for JSON IOC validation'
═══ WINDOWS ═══
Run on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t33-ti/roe.txt | Select-String never
python --version 2>$null; if (-not $?) { Write-Output 'Install Python for IOC validation lab' }Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); OASIS STIX (https://oasis-open.github.io/cti-documentation/stix/intro.html); MISP (https://www.misp-project.org/documentation/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check against misuse patterns
Grep notes for 'marketplace,' criminal forum names, live victim IOC dumps, stolen credential references — redact or delete. Rewrite forum habits to $TI_LAB placeholders before you copy workflows.
Classmates build their own setup packs for their $TI_LAB — not yours.
3. Lock the proof
chmod 600 on the pack. Quiz is next — then TI Types.
TI mentors archive lab setup before first enrichment drill; you are practicing that habit early.
4. What you ship: TI lab setup pack for $TI_LAB
Setup pack: scope, IOC row, ethics card. $TI_LAB named. NEVER criminal markets. chmod 600.
5. What you record before the next lesson
Date. Setup pack path. $TI_LAB scope note. File t33-m01-l04-lab-setup.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip the file and import live breach IOC dump. Add criminal marketplace to approved list.
Right
Write YOUR lab setup pack for $TI_LAB. chmod 600. Next: Quiz — TI Mindset and Lab.
Mission: freeze YOUR TI lab setup pack on disk
1) Merge scope, IOC inventory, ethics sections. 2) Name $TI_LAB. 3) chmod 600. Never list criminal marketplace access as approved practice.
Stuck? Ask Cyberlium AI Mentor
Setup packs are boring on purpose — boring keeps TI work defensible.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: You should chmod 600 on TI lab notes.
True or False
Knowledge Check
APPLY: A tutorial accesses criminal marketplace without scope. You:
Multiple choice