Active › Module 10 › Lesson 4
Lab — Capstone
Execute capstone on $LAB_AD — checklist, lab path, evidence pack sealed; zero attack cookbooks.
Visual · t25_capstone_lab
Capstone: checklist × $LAB_AD literacy evidence. Original Cyberlium.
Opening
Close the AD literacy loop — paths named, defenses applied, detection mapped, report shipped — without a stranger-domain cookbook.
Walk Topic 25 checklist on YOUR $LAB_AD: verify RoE, lab path current, paths lab with defender fixes, defense lab hardening applied, detection lab with ATT&CK gaps, report lab with purple retest, evidence pack indexed, scan for attack cookbooks (must be zero). Update index with capstone UTC completion. Purple paragraph: tiering or detection key insight from YOUR path. No DCSync/Kerberoast/PtH cookbooks against strangers, no unauthorized SIEM, no hash dump attachments. Optional mentor review — three clarity questions. Revert $LAB_AD snapshot after if brief requires.
1. Execute checklist
Check each row; link artifact or N/A; confirm zero refused techniques in any file.
Scan sealed pack for Mimikatz/DCSync cookbook — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ WINDOWS / POWERSHELL (Active Directory Lab) ═══
Check current user, domain context, and security privileges
Command — copy this
whoami /user /groups /priv
Query active Domain Controller and trust relationships
Command — copy this
nltest /dsgetdc:$env:USERDOMAIN nltest /domain_trusts
List password policy across the domain
Command — copy this
net accounts /domain
Check Kerberos ticket cache
Command — copy this
klist
═══ LINUX / BASH (Lab Network) ═══ Test DNS SRV resolution for Active Directory services
Command — copy this
dig _ldap._tcp.dc._msdcs.lab.local SRV +short dig _kerberos._tcp.dc._msdcs.lab.local SRV +short
Primary tools to practice this lesson: nmap, curl, grep, python3. Reference sites: Capstone AD literacy (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dmc/active-directory-domain-services); MITRE ATT&CK (https://attack.mitre.org/matrices/enterprise/); Microsoft PAW/tiering (https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model); BloodHound docs (https://bloodhound.readthedocs.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Purple paragraph
Detection or hardening key → defender uplift idea from YOUR lab path.
Name what breaks if you skip RoE or ship attack cookbook — integrity tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 26 Digital Forensics (DFIR) on separate authorized track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + purple paragraph + zero cookbook scan.
5. What you record before the next lesson
Capstone pack path. $LAB_AD quiet.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone includes DCSync output from unauthorized domain.
Right
Capstone complete on $LAB_AD with full teardown. Next: topic quiz.
Mission: Topic 25 capstone
1) Walk checklist with evidence links. 2) Purple paragraph from your path. 3) Seal pack — zero cookbook files. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Attack cookbook capstone deliverable earns credit.
True or False
Knowledge Check
APPLY: Capstone teardown includes:
Multiple choice