Offensive Methodology Mastery — The Adversary Playbook, for Defenders and Authorized Testers

What this is. A phase-equivalent, cross-cutting module on how attackers actually operate end to end — the unified lifecycle (reconnaissance → initial access → execution → persistence → privilege escalation → lateral movement → collection → command-and-control → exfiltration → impact) and the three frameworks that structure it (the Cyber Kill Chain, the Diamond Model, and MITRE ATT&CK). The rest of the track teaches you to build and defend systems; this module teaches you to think in attacks across the whole campaign, which is what a penetration tester, red-teamer, threat hunter, detection engineer, or incident responder does every day.

Why it exists (the gap it closes). The other phases cover attacker techniques locally — a memory bug here, an SSRF there, an over-permissioned IAM role elsewhere. What was missing was the connective tissue: how an attacker chains those into a campaign, and the mental models a defender uses to detect the chain early and break it. You cannot defend, hunt, or emulate an adversary you can't model end to end.

The ethical frame (read this first — it is not optional). This module is the attacker's playbook taught for defense and authorized testing, fully consistent with Phase 00:

• Everything is authorized-lab-only and reasons over synthetic metadata (event logs, network graphs, intel records) in the labs — there is no exploitation, no live targets, no payloads.
• Knowing the lifecycle is what lets you detect and disrupt it (every offensive concept here ends in a defensive break-the-chain lesson) and lets an authorized pentester/red-teamer emulate threats safely and report them.
• The difference between an attacker and a defender is authorization and intent, not knowledge — the same lesson as Phase 08's adversary chapter. This module gives you the knowledge under that boundary.

Prerequisites. The whole track, especially Phases 02 (web/identity), 05 (OS/AD), 07 (cloud/IAM), and 09 (IR/detection). The labs are pure Python (stdlib + pytest), offline.

Learning Objectives

By the end you can, without notes:

1. Walk the attacker lifecycle end to end and name, for each stage, the goal, common techniques, the telemetry it produces, and the control that breaks the chain there.
2. Use the three lenses correctly and know when each helps: Cyber Kill Chain (the linear campaign phases), Diamond Model (adversary / capability / infrastructure / victim, and pivoting between events), and MITRE ATT&CK (the technique matrix).
3. Reconstruct a campaign from scattered events, map each to its phase/technique, and identify the earliest disruption point.
4. Reason about lateral movement and pivoting as reachability over a host/credential graph, and find the choke points a defender should cut.
5. Correlate events with the Diamond Model to pivot from one indicator to related infrastructure and capability — the core of threat-intelligence analysis.
6. Design a safe, authorized adversary-emulation plan (scope, ATT&CK technique selection, stop conditions) and explain how purple-teaming closes detection gaps.

The three lenses (read the WARMUP for depth)

CYBER KILL CHAIN   linear campaign phases       "how far along is this intrusion?"   → break early
DIAMOND MODEL      adversary/capability/         "what else is connected to this?"    → pivot & attribute
                   infrastructure/victim
MITRE ATT&CK       tactic → technique matrix     "what behavior, and can we detect it?" → coverage

See WARMUP.md for the full from-zero treatment of the lifecycle, the three frameworks, each stage's techniques and defensive counters, and adversary emulation / purple teaming.

Labs

Each lab follows LAB-STANDARD.md: lab.py (TODOs), complete solution.py, adversarial test_lab.py, README.md, requirements.txt.

cd lab-01-killchain-attack-mapper
LAB_MODULE=solution pytest -q   # reference passes
pytest -q                        # your implementation after the TODOs

Deliverables

• A campaign reconstructor that orders scattered events into kill-chain phases, maps each to an ATT&CK tactic, and reports the earliest stage a control could have broken the chain.
• A pivot planner that computes which hosts an attacker reaches from a foothold given credential and network edges, and identifies the choke-point hosts/credentials a defender should cut.
• A Diamond-Model correlator that links events sharing infrastructure or capability and clusters them into campaigns — the analytic move behind threat attribution.
• The ability to explain the lifecycle and the three frameworks fluently in an interview, and to scope a safe adversary-emulation engagement.

Safety

Authorized-lab-only and entirely offline; the labs reason over synthetic event/graph/intel metadata. No exploitation, no live targets, no payloads, no persistence/stealth tooling. This module builds judgment about attacker campaigns — the staff-level skill that makes the offensive knowledge a defensive asset.