SOC › Module 1 › Lesson 3
No Offensive Playbooks
No offensive playbooks means refuse lateral movement, credential dumping, and exploit how-to — write the refusal habit into YOUR $HUNT_LAB ethics card.
Visual · t30_no_offensive_playbooks
Offensive refusal. $HUNT_LAB only. Original Cyberlium.
Opening
Forum exploit chains, Mimikatz tutorials, and pass-the-hash cookbooks — all stop outside authorized defensive scope. Literacy names the technique; hunts stay on lab telemetry.
Offensive playbooks include step-by-step lateral movement guides, credential dumping walkthroughs, exploit deployment scripts, and live attack emulation against systems you do not own. Org scope follows ownership: finance, health, and SaaS telemetry without ticket stay off limits. Cyberlium practices refusal sentences on YOUR $HUNT_LAB — 'I hunt only sample telemetry and name techniques for detection context' — never copy forum threads that aim exploit tooling at live services. Next: Lab Setup.
1. Offensive patterns refused (named, literacy only)
Lateral movement cookbooks: step-by-step guides to pivot through live networks — named for ATT&CK literacy, NOT executed on Cyberlium. Credential dumping how-to: tooling walkthroughs against live domains — defender fix is detection and hardening, not student replication.
On $HUNT_LAB, write three refusal triggers — e.g., exploit script request, credential dump tutorial, live lateral movement against stranger hosts.
Command guide
Try these commands — Offensive patterns refused (named, literacy only)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE ATT&CK (https://attack.mitre.org/); SANS (https://www.sans.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why refusal protects you and others
Unauthorized access laws and employer policy apply to offensive tooling — skill without scope is career and legal risk. Victim data: production telemetry contains PII, credentials, and session tokens you must not exfiltrate.
Defenders detect and contain these techniques — students practice naming them for hunt hypotheses on lab scenarios and defender notes only.
3. Ethics card habit
Forbidden: running credential dump tools on live AD, sharing exploit chains in class chat, importing victim PCAP without scope. Allowed: ethics card — allowed telemetry samples, NEVER list, refusal sentence you will say aloud.
Ship: hunt ethics card with NEVER list and one refusal sentence. Next: Lab Setup.
4. What you ship: hunt ethics card for $HUNT_LAB
Allowed telemetry, NEVER list, refusal sentence. $HUNT_LAB named. NO offensive playbooks. chmod 600.
5. What you record before the next lesson
Date. Ethics card. $HUNT_LAB named. File t30-m01-l03-no-offensive-playbooks.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Follow Mimikatz tutorial on employer domain 'for detection.' Share exploit chain in Discord.
Right
Write hunt ethics card for YOUR $HUNT_LAB. Next: Lab Setup.
Mission: write YOUR offensive refusal habit
1) List three NEVER targets (lateral movement how-to, credential dumping, live exploit scripts). 2) Write one refusal sentence for offensive playbook requests. 3) Name allowed $HUNT_LAB surfaces. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Name techniques for detection — never replicate attacks on systems you do not own.
Knowledge Check
APPLY: No offensive playbooks on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: ATT&CK techniques are taught as named risk classes with defender notes — not as live attack cookbooks.
True or False
Knowledge Check
APPLY: Discord link to credential dump tutorial for live domain — you:
Multiple choice