Active › Module 8 › Lesson 4
Lab — Detection
Detection literacy lab on $LAB_AD — event ID sheet, ATT&CK map, honeytoken plan, purple detection gap table.
Visual · t25_detection_lab
Lab: detection pack on YOUR $LAB_AD logs/scenarios. Original Cyberlium.
Opening
Prove blue can see what red names — in your lab SIEM table, not on a stranger domain's silence.
On YOUR $LAB_AD per brief: (1) finalize Event ID cheat sheet with alert hypotheses; (2) ATT&CK mapping table ≥5 techniques with detection gaps; (3) one honeytoken plan row deployed or simulated in lab with expected events; (4) purple detection exercise — authorized lab action (e.g., brief-assigned Kerberoast simulation on lab SPN) and document which Event IDs should fire — observe-only if brief forbids live red; (5) gap remediation recommendation per gap row; (6) integrity — $LAB_AD/synthetic only; (7) chmod 600 pack. No stranger log imports, no disabling SIEM on unauthorized systems, no attack cookbook attachments.
1. Detection pack
Event IDs + ATT&CK + honeytoken + gap table — cross-linked index.
Purple paragraph: what fired vs expected on lab exercise.
Command guide
Try these commands — Detection pack
═══ WINDOWS / POWERSHELL (Active Directory Lab) ═══
Check current user, domain context, and security privileges
Command — copy this
whoami /user /groups /priv
Query active Domain Controller and trust relationships
Command — copy this
nltest /dsgetdc:$env:USERDOMAIN nltest /domain_trusts
List password policy across the domain
Command — copy this
net accounts /domain
Check Kerberos ticket cache
Command — copy this
klist
═══ LINUX / BASH (Lab Network) ═══ Test DNS SRV resolution for Active Directory services
Command — copy this
dig _ldap._tcp.dc._msdcs.lab.local SRV +short dig _kerberos._tcp.dc._msdcs.lab.local SRV +short
Primary tools to practice this lesson: curl, grep. Reference sites: Detection lab (https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/); MITRE detection (https://attack.mitre.org/); CISA SOC guidance (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Simulated vs live
If brief allows live lab red on $LAB_AD — document UTC and revert snapshot.
If simulate-only — mark scenario rows clearly observed vs tabletop.
3. Integrity
No employer SIEM queries without authorization. Lab domain in all samples.
Detection output feeds Module 9 blue findings — not public exploit drop.
4. What you ship: detection lab pack
Event IDs + ATT&CK + honeytoken + purple gap table — chmod 600.
5. What you record before the next lesson
Detection lab pack path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Detection lab uses leaked enterprise SIEM export without authorization.
Right
Detection lab pack on $LAB_AD. Next: quiz.
Mission: detection lab
1) Event ID sheet finalized. 2) ATT&CK map with gaps. 3) Honeytoken row. 4) Purple exercise note; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Tabletop vs live purple — document how?”
Knowledge Check
APPLY: Detection lab includes:
Multiple choice
Knowledge Check
APPLY: True or False: Disable logging to test detection lab.
True or False
Knowledge Check
APPLY: Purple exercise documents:
Multiple choice