Purple › Module 6 › Lesson 3
Safe Lab Tests
Safe lab test literacy — pre-flight checks, isolated VMs, cleanup verification, detection observer role — safe atomic execution on YOUR `$PURPLE_LAB`.
Visual · t35_safe_lab_tests
Safe lab tests = named pre-flight rows. $PURPLE_LAB. Original Cyberlium.
Opening
Atomic tests can break lab hosts — name pre-flight and cleanup rows on YOUR lab VMs before execution, never skip observer role or rollback.
Safe lab test literacy names: snapshot or restore point category, network isolation check category, blue team observer notified category, atomic executor dry-run stub category, and post-test cleanup verification category. Analyst documents safe test checklist on `$PURPLE_LAB` lab VM — ties each row to RoE from 6-2 and atomic card from 6-1 — without running destructive atomics without snapshot, without disabling EDR to 'pass' detection, without leaving persistence on lab host. Cyberlium teaches honest safe execution — purple coordination literacy on YOUR notes. Refused: EDR disable, skip cleanup, unauthorized prod atomic. Lab row: safe test checklist (five pre-flight rows, cleanup verification, UTC).
1. Named pre-flight rows
Snapshot, isolation check, observer notified, dry-run stub, cleanup verification — five literacy anchors.
Each row has pass/fail criteria — not subjective 'should be fine.'
Command guide
Try these commands — Named pre-flight rows
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE T1082 (https://attack.mitre.org/techniques/T1082/); Atomic T1082 (https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1082); Atomic Red Team (https://github.com/redcanaryco/atomic-red-team). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Observer discipline
Blue observer confirms detection pipeline live before red executes — document UTC on lab stub.
Failed pre-flight aborts test — no 'run anyway' on lab host.
3. Refused
No EDR disable to pass detection; no skip cleanup; no prod atomic without RoE.
Safe test literacy supports repeatable purple work — not reckless sims.
4. What you ship: safe test checklist
Five pre-flight rows + cleanup verification + observer UTC + NEVER EDR disable line.
5. What you record before the next lesson
Safe test checklist path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Disable EDR on lab VM so atomic 'passes' detection validation faster.
Right
Safe test checklist from `$PURPLE_LAB` lab VM stub. Next: Atomic Lab.
Mission: safe test checklist
1) Name five safe test rows. 2) Pass/fail criteria per row. 3) Observer notification UTC stub. 4) Write NEVER EDR disable line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Snapshot vs restore point — literacy default?”
Knowledge Check
APPLY: Safe lab test literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Failed pre-flight should abort atomic test.
True or False
Knowledge Check
APPLY: Safe test checklist includes:
Multiple choice