seclab/ASSESSMENT_RUBRICS.md

ASSESSMENT RUBRICS

Apophis Networking Cybersecurity Applied Lab

---

MODULE-LEVEL ASSESSMENT RUBRIC

Each module (MOD0-MOD8) is assessed on the following criteria:

Criterion	Excellent (90-100%)	Proficient (80-89%)	Developing (70-79%)	Needs Improvement (<70%)
Technical Execution	All labs completed flawlessly; goes beyond requirements with additional exploration	All required labs completed correctly; minor errors quickly corrected	Most labs completed; some troubleshooting issues requiring instructor help	Labs incomplete or significant errors unresolved
Documentation	Comprehensive notes with commands, screenshots, and analysis; publication-ready	Complete documentation with all required elements; minor formatting issues	Basic documentation present; missing some screenshots or command history	Incomplete or disorganized documentation
Conceptual Understanding	Demonstrates deep understanding; can explain "why" behind every action	Solid grasp of concepts; can articulate attack/defense tradeoffs	Surface-level understanding; follows instructions without full comprehension	Limited understanding; cannot explain what they did or why
Troubleshooting	Independently resolves all issues using logs, research, and critical thinking	Resolves most issues with minimal guidance; uses systematic approach	Struggles with troubleshooting; requires step-by-step instructor support	Cannot troubleshoot; gives up easily when errors occur
Time Management	Completes module in recommended timeframe or faster	Completes within 1.5x recommended time	Requires 2x+ recommended time	Does not complete within reasonable timeframe

---

MODULE 0: PREREQUISITES - ASSESSMENT

Passing Criteria: Must demonstrate proficiency in ALL prerequisite skills before proceeding.

Linux CLI Fundamentals (25 points)

• Navigate filesystem (cd, ls, pwd) - 5 pts
• File permissions (chmod, chown, understanding rwx) - 5 pts
• Log analysis (grep, tail, awk on /var/log) - 5 pts
• User management (useradd, passwd, su) - 5 pts
• Process management (ps, top, kill) - 5 pts

Windows Fundamentals (25 points)

• PowerShell cmdlets (Get-EventLog, Get-Service, Get-Process) - 10 pts
• Event Viewer navigation and filtering - 10 pts
• Identify critical Event IDs (4624, 4625, 4672) - 5 pts

Networking Fundamentals (25 points)

• Subnetting calculations (hand calculation + verification) - 10 pts
• Ping/traceroute interpretation - 5 pts
• Understand TCP/IP stack and OSI model - 10 pts

Virtualization (25 points)

• Create and restore VM snapshots - 10 pts
• Configure VM network modes (NAT, Bridged, Host-Only) - 10 pts
• Explain Type 1 vs Type 2 hypervisors - 5 pts

TOTAL: 100 points Pass Threshold: 80/100 (Students below 80 must remediate before MOD1)

---

MODULE 1-5: CORE SKILLS - DETAILED RUBRICS

MOD1: Secure Infrastructure Provisioning (100 points)

Task	Points	Criteria
Proxmox VLAN Configuration	20	Bridge is VLAN-aware; verified in /etc/network/interfaces
pfSense Deployment	20	VM created with correct specs; pfSense installed and accessible
VLAN Interface Creation	20	VLANs 200, 300, 400 created and assigned to interfaces
Firewall Rules	25	Red→Victim allowed; Victim→Red blocked; Victim→WAN blocked
Validation Testing	15	All 5 tests pass (connectivity, isolation, internet access)

MOD2: Reconnaissance & NTA (100 points)

Task	Points	Criteria
Nmap Scanning	20	Multiple scan types demonstrated (-sS, -sV, -A, -p-)
Service Enumeration	20	FTP, SMB, HTTP enumerated with appropriate tools
Wireshark Analysis	25	PCAP captured; SYN scan identified; TCP streams analyzed
Scan Type Identification	15	Can distinguish SYN vs Connect vs UDP scans in PCAP
Documentation	20	Comprehensive recon report with network diagram

MOD3: Exploitation & Post-Exploitation (100 points)

Task	Points	Criteria
Metasploit Exploitation	25	vsftpd and/or Samba successfully exploited
Meterpreter Usage	20	Post-exploitation commands executed (sysinfo, hashdump, etc.)
Manual Exploitation	15	vsftpd exploited without Metasploit (netcat method)
Privilege Escalation	20	Demonstrates at least 2 privesc techniques
Persistence	10	Establishes persistence via SSH keys or cron
Documentation	10	Attack chain documented with screenshots

MOD4: Defensive Monitoring (100 points)

Task	Points	Criteria
Security Onion Deployment	20	SO installed and sensors operational
Alert Detection	25	Can identify nmap scans and exploitation in alerts
Custom Rule Writing	30	Creates working Suricata/Zeek rule for specific attack
Log Analysis	15	Correlates Suricata alerts with Zeek conn logs
Documentation	10	Detection engineering notes with rule explanations

MOD4.5: SIEM Operations (100 points)

Task	Points	Criteria
KQL Query Mastery	25	Writes 10+ functional queries for threat hunting
Dashboard Creation	25	Builds custom Kibana dashboard with 5+ visualizations
Alert Tuning	20	Reduces false positives via threshold.config
Log Correlation	20	Links recon → exploit → post-exploit in timeline
Dashboard Integration	10	Exports data for React SOC dashboard

MOD5: Active Directory (100 points)

Task	Points	Criteria
AD Deployment	20	Domain Controller promoted; domain created
Domain Join	10	Windows 10 successfully joined to domain
Kerberoasting Attack	30	Captures service tickets; cracks with hashcat
Pass-the-Hash	20	Uses impacket for lateral movement
Defense Documentation	20	Explains how to detect each attack in logs

---

MODULE 6-8: ADVANCED TOPICS - RUBRICS

MOD6: Incident Response (100 points)

Task	Points	Criteria
Disk Forensics	25	Acquires image; calculates hashes; analyzes with Autopsy
Memory Forensics	25	Captures dump; analyzes with Volatility; finds malicious process
Network Forensics	20	Reconstructs attack from PCAP; extracts transferred files
IR Report Writing	20	Follows NIST PICERL; includes timeline and IOCs
Remediation Plan	10	Provides actionable, prioritized recommendations

MOD7: Web Application Security (100 points)

Task	Points	Criteria
SQL Injection	20	Manual and SQLMap exploitation; data extracted
XSS Attack	20	Demonstrates reflected and stored XSS
Burp Suite Usage	20	Intercepts traffic; uses Repeater and Intruder
WAF Configuration	20	Deploys ModSecurity/Suricata rules to block attacks
Detection in SO	20	Creates KQL queries and detection rules for web attacks

MOD8: Threat Intelligence (100 points)

Task	Points	Criteria
MITRE Mapping	25	Maps all MOD3 attacks to correct tactics/techniques
IOC Database	20	Creates structured IOC list (IP, hash, file, network)
Threat Hunting	25	Executes 3 hypothesis-driven hunts with results
Sigma Rules	15	Writes 2+ functional Sigma rules
Dashboard Update	15	Integrates MITRE coverage heatmap into React dashboard

---

CAPSTONE PROJECT: COMPREHENSIVE RUBRIC (200 points)

Weight: Equivalent to 2 modules

Category	Max Points	Excellent (90-100%)	Proficient (80-89%)	Developing (70-79%)	Needs Improvement (<70%)
Red Team Execution	50	Novel TTPs; multi-stage campaign; perfect stealth	All required attack phases completed; good stealth	Basic attacks executed; some noisy techniques	Incomplete attack chain; easily detected
Blue Team Detection	50	Detects all phases; accurate attribution; timeline perfect	Detects most attacks; good forensic analysis	Detects initial access only; incomplete timeline	Fails to detect multiple attack phases
Technical Documentation	40	Publication-quality; comprehensive appendices	Complete with all required sections	Basic documentation; missing some elements	Incomplete or poorly organized
Remediation Plan	20	Detailed; cost-benefit analysis; prioritized; realistic	Actionable recommendations; reasonable priorities	Generic recommendations; no prioritization	Vague or unrealistic suggestions
Dashboard Integration	20	Fully functional; interactive; accurate data	Data integrated; basic visualizations	Partial integration; some errors	Dashboard not updated or broken
Presentation	20	Engaging; clear narrative; professional slides	Organized; covers all points; adequate slides	Basic presentation; some unclear points	Disorganized or incomplete presentation

TOTAL: 200 points

Capstone Grading Scale:

• 180-200: A (Exceptional - ready for professional SOC role)
• 160-179: B (Strong - demonstrates competency)
• 140-159: C (Acceptable - meets minimum standards)
• 120-139: D (Needs improvement - remediation required)
• <120: F (Fails to demonstrate minimum competency)

---

OVERALL COURSE GRADING SCHEME

Point Distribution

Component	Points	Percentage
MOD0 (Prerequisites)	100	5%
MOD1 (Infrastructure)	100	8%
MOD2 (Reconnaissance)	100	8%
MOD3 (Exploitation)	100	8%
MOD4 (Defensive Monitoring)	100	8%
MOD4.5 (SIEM Operations)	100	8%
MOD5 (Active Directory)	100	8%
MOD6 (Incident Response)	100	9%
MOD7 (Web App Security)	100	9%
MOD8 (Threat Intelligence)	100	9%
CAPSTONE PROJECT	200	20%
TOTAL	1200	100%

Final Letter Grades

Grade	Point Range	Percentage	Description
A	1080-1200	90-100%	Exceptional mastery; ready for professional cybersecurity role
B	960-1079	80-89%	Strong understanding; competent in most areas
C	840-959	70-79%	Adequate knowledge; meets minimum standards
D	720-839	60-69%	Below expectations; significant gaps in knowledge
F	<720	<60%	Does not meet minimum competency for certification

---

SELF-ASSESSMENT CHECKLIST

Use this to gauge your readiness before final assessment:

Red Team Skills

• Can perform network reconnaissance using nmap (multiple scan types)
• Can identify and exploit common vulnerabilities (FTP, SMB, web apps)
• Understands Metasploit Framework architecture (exploits, payloads, handlers)
• Can perform privilege escalation on Linux and Windows
• Can establish persistence mechanisms
• Can perform Active Directory attacks (Kerberoasting, PTH)

Blue Team Skills

• Can deploy and configure Security Onion
• Can write custom Suricata and Zeek rules
• Can query logs using KQL (Kibana Query Language)
• Can perform disk forensics with Autopsy
• Can perform memory forensics with Volatility
• Can analyze PCAPs for attack indicators

Analytical Skills

• Can map attacks to MITRE ATT&CK framework
• Can create and use IOCs for threat detection
• Can perform hypothesis-driven threat hunting
• Can write comprehensive incident response reports
• Can develop remediation plans with cost/benefit analysis

Technical Writing

• Can document procedures clearly and reproducibly
• Can write executive summaries for non-technical stakeholders
• Can create technical diagrams (network maps, attack flows)
• Can follow professional report templates

Soft Skills

• Can troubleshoot independently using logs and research
• Can manage time effectively across complex projects
• Can present technical findings to mixed audiences
• Can think critically about attack/defense tradeoffs

---

REMEDIATION GUIDELINES

If you score below 70% on any module:

1. Review Foundational Concepts:

   • Re-read module documentation
   • Watch supplemental videos (Professor Messer, HackerSploit, IppSec)

2. Hands-On Practice:

   • Repeat failed labs with detailed note-taking
   • Try variations of the attack/defense technique
   • Use TryHackMe or HackTheBox for additional practice

3. Seek Clarification:

   • Document specific errors/confusion points
   • Research error messages (Google, Stack Overflow, Reddit r/AskNetsec)
   • Review relevant MITRE ATT&CK technique pages

4. Re-Assessment:

   • Rebuild VMs from clean snapshots
   • Attempt labs again without referring to previous notes
   • Submit new lab report for re-grading

5. Progress Criteria:

   • Must achieve 70% or higher on remediation attempt
   • If still below 70%, one-on-one tutoring recommended
   • Cannot proceed to Capstone without passing all modules

---

CERTIFICATION RECOMMENDATION

Upon successful completion (C or higher), students are recommended for:

Entry-Level Certifications:

• CompTIA Security+ (if not already obtained)
• CompTIA CySA+ (Cybersecurity Analyst)
• CompTIA PenTest+ (Penetration Testing)

Intermediate Certifications:

• GIAC Security Essentials (GSEC)
• GIAC Certified Intrusion Analyst (GCIA)
• eLearnSecurity Junior Penetration Tester (eJPT)

Advanced Certifications (with additional study):

• Offensive Security Certified Professional (OSCP)
• GIAC Certified Incident Handler (GCIH)
• Certified Ethical Hacker (CEH)

Students scoring A in Capstone are well-prepared for OSCP-level challenges.

---

INSTRUCTOR NOTES

Grading Consistency

• Use this rubric for all students to ensure fairness
• Document any exceptions or accommodations
• Provide detailed feedback on point deductions

Common Student Challenges

• MOD0: Underestimate importance; skip ahead (enforce prerequisite check)
• MOD1: VLAN tagging errors (most common troubleshooting issue)
• MOD3: Wrong LHOST IP (check this first when exploits fail)
• MOD4: Alert fatigue (teach tuning early)
• Capstone: Time management (enforce interim deadlines)

Encouraging Excellence

• Highlight exceptional work as examples for future students
• Offer bonus points for creative attack/defense techniques
• Encourage publication of findings (blog posts, conference talks)

---

END OF ASSESSMENT RUBRICS