Active › Module 9 › Lesson 1
Findings for Blue
Write AD findings for blue team from $LAB_AD — structured rows, observed vs inferred, ATT&CK and Event ID links, no attack cookbooks.
Visual · t25_findings_for_blue
Findings for blue = defender-ready report rows. $LAB_AD sourced. Original Cyberlium.
Opening
Blue needs a finding they can ticket — not a stranger-domain attack montage with Mimikatz screenshots.
AD finding structure for blue: title, affected object ($LAB_AD domain/OU/account), misconfiguration class (ACL path, weak SPN, tier violation, missing Guard), observed evidence (log excerpt, graph edge name, config read — from authorized lab), ATT&CK technique ID, recommended detection (Event ID + alert name from Module 8), severity in lab context. Observed vs inferred labels mandatory. Cyberlium findings from $LAB_AD and authorized purple exercises — NOT findings from unauthorized prod AD tests, NOT attach full Kerberoast/DCSync command transcripts against strangers, NOT publish live cred dumps as severity proof. chmod 600 under $HOME/cyberlium-lab/reports. Feeds capstone evidence pack.
1. Finding row template
Summary, asset, misconfig class, evidence, ATT&CK, detection, severity, owner recommendation.
Blue-readable: ticket title suggestion in summary line.
Command guide
Try these commands — Finding row template
═══ WINDOWS / POWERSHELL (Active Directory Lab) ═══
Check current user, domain context, and security privileges
Command — copy this
whoami /user /groups /priv
Query active Domain Controller and trust relationships
Command — copy this
nltest /dsgetdc:$env:USERDOMAIN nltest /domain_trusts
List password policy across the domain
Command — copy this
net accounts /domain
Check Kerberos ticket cache
Command — copy this
klist
═══ LINUX / BASH (Lab Network) ═══ Test DNS SRV resolution for Active Directory services
Command — copy this
dig _ldap._tcp.dc._msdcs.lab.local SRV +short dig _kerberos._tcp.dc._msdcs.lab.local SRV +short
Primary tools to practice this lesson: python3, grep. Reference sites: Findings for blue (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices); MITRE ATT&CK (https://attack.mitre.org/); Microsoft security operations (https://learn.microsoft.com/en-us/security/operations/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence hygiene
Redact paths; lab domain only; graph edge names OK — stranger hostnames refused.
Log lines synthetic or $LAB_AD — label source.
3. Scope integrity
$LAB_AD RoE block in every report pack.
Refused: dramatized DA takeover video from unauthorized AD.
4. What you ship: blue finding template
Finding row fields + observed/inferred rule + sample row from lab.
5. What you record before the next lesson
Blue finding template path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Finding includes DCSync output from employer DC as evidence.
Right
Blue finding template from $LAB_AD work. Next: Remediation Recs.
Mission: blue finding template
1) List finding row fields. 2) Write observed vs inferred rule. 3) Draft one finding from paths lab. 4) Link Event ID detection.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Severity without exploit demo?”
Knowledge Check
APPLY: Blue finding includes:
Multiple choice
Knowledge Check
APPLY: True or False: Unauthorized AD test findings belong in report.
True or False
Knowledge Check
APPLY: Finding evidence should:
Multiple choice