Forge Missions

SOC investigations: triage a queue, hunt, and prove your conclusion.

Open SOC command Every line side by side

What is in it

For soc lead, mssp delivery manager — make analysts accurate and fast on work that looks like their own.

Alert queue with innocent lookalikes, so closing everything scores badly
SIEM, endpoint, case service and the wire all reading one estate
Dwell time, containment time and SLA clocks scored, not just logged
Cases mapped to ATT&CK from detections that actually fired

What it is not

Simulated tool surfaces, not a licensed vendor console
Does not validate your production SIEM or EDR deployment

Forge Missions against the field

15 capabilities that matter for this purchase, next to the platforms a buyer shortlists in this lane: LetsDefend, TryHackMe SOC Simulator, Cyberbit, HTB Threat Range.

The alert queue, the SIEM, the endpoint and the case service all read one estate, so an analyst can corroborate across tools instead of reading a transcript.
The queue is salted with innocent lookalikes, so closing everything scores badly.
Every alert opens a real case scoped to that scenario's own estate, never a shared global inbox.

Forge Missions capability comparison against 4 platforms
What you need	Forge MissionsIncluded in the platform	HTB	THM	Cyberbit	LetsDefend
SOC investigation exercise	Yes See it live	Hack The Box: Documented for SOC investigation exercise	TryHackMe: Documented for SOC investigation exercise	Cyberbit: Documented for SOC investigation exercise	LetsDefend: Documented for SOC investigation exercise
Alert triage with true and false positive decisions	Yes See it live Every case ships with innocent lookalikes so closing everything scores badly.	Hack The Box: Documented for Alert triage with true and false positive decisions	TryHackMe: Documented for Alert triage with true and false positive decisions	Cyberbit: Limited for Alert triage with true and false positive decisions	LetsDefend: Documented for Alert triage with true and false positive decisions
SIEM query and investigation practice	Yes See it live	Hack The Box: Documented for SIEM query and investigation practice	TryHackMe: Documented for SIEM query and investigation practice	Cyberbit: Documented for SIEM query and investigation practice	LetsDefend: Documented for SIEM query and investigation practice
Endpoint analysis and access	Yes See it live	Hack The Box: Documented for Endpoint analysis and access	TryHackMe: Limited for Endpoint analysis and access	Cyberbit: Documented for Endpoint analysis and access	LetsDefend: Documented for Endpoint analysis and access
Threat hunting kept separate from alert triage	Yes See it live	Hack The Box: Documented for Threat hunting kept separate from alert triage	TryHackMe: Documented for Threat hunting kept separate from alert triage	Cyberbit: Documented for Threat hunting kept separate from alert triage	LetsDefend: Documented for Threat hunting kept separate from alert triage
Investigation that crosses multiple tools	Yes See it live One estate behind SIEM, EDR, case service, network devices and the wire.	Hack The Box: Documented for Investigation that crosses multiple tools	TryHackMe: Documented for Investigation that crosses multiple tools	Cyberbit: Documented for Investigation that crosses multiple tools	LetsDefend: Limited for Investigation that crosses multiple tools
Analyst report or evidence submission	Yes See it live	Hack The Box: Documented for Analyst report or evidence submission	TryHackMe: Documented for Analyst report or evidence submission	Cyberbit: Documented for Analyst report or evidence submission	LetsDefend: Limited for Analyst report or evidence submission
Measured investigation and response timing	Yes See it live Dwell time, containment time and SLA clocks are scored, not just recorded.	Hack The Box: Documented for Measured investigation and response timing	TryHackMe: Documented for Measured investigation and response timing	Cyberbit: Documented for Measured investigation and response timing
Detection-engineering curriculum	Yes See it live	Hack The Box: Limited for Detection-engineering curriculum	TryHackMe: Documented for Detection-engineering curriculum	Cyberbit: Limited for Detection-engineering curriculum	LetsDefend: Documented for Detection-engineering curriculum
SOAR concepts and workflow training	Yes See it live		TryHackMe: Limited for SOAR concepts and workflow training	Cyberbit: Limited for SOAR concepts and workflow training	LetsDefend: Limited for SOAR concepts and workflow training
Learner authors an executable SOAR playbookDeliberately stricter than the row above: a SOAR-looking screen is not a runtime.	Yes See it live Draft, run, fail, repair and rerun against the live estate, with an audit trail.
Connector failure and replay debugger for automation	Yes See it live Deterministic integration faults with idempotent retries. Not established for any vendor in the research.
Configuration changes alter the exercise	Yes See it live Firewall, routing and policy edits change what the wire and the SIEM then show.	Hack The Box: Documented for Configuration changes alter the exercise	TryHackMe: Limited for Configuration changes alter the exercise	Cyberbit: Documented for Configuration changes alter the exercise	LetsDefend: Limited for Configuration changes alter the exercise
Rogue access point owned by the estate, not scripted	Yes See it live
Each scenario carries its own SIEM, alerts and case databaseNo shared global console: an alert raises a case on the estate it came from, and cannot leak into another team's exercise.	Yes See it live		TryHackMe: Limited for Each scenario carries its own SIEM, alerts and case database	Cyberbit: Limited for Each scenario carries its own SIEM, alerts and case database	LetsDefend: Limited for Each scenario carries its own SIEM, alerts and case database

The run behind this line: One attachment to data out the door

An invoice attachment becomes a running implant, a scheduled task and a slow trickle of files leaving the estate.

Opponent: Access broker handing off to a data-theft crew. Shaped after Qakbot-style attachment delivery into hands-on-keyboard theft. Technique and zone identifiers are published by MITRE and ISA/IEC; the mapping is ours and is not an accreditation.

How it starts — the message delivered to the mailbox

From: Accounts Payable <ap@invoices-northwind.example>
Subject: Remittance advice 88421 — payment held pending confirmation
Attachment: Remittance_88421.docm (Word macro document)

A macro document from outside the organization
The sender domain is a near miss of the real supplier domain
Urgency about a payment nobody in finance raised

Graded verdict: phish — T1566.001. Nothing here sends or resolves anywhere real.

The steps, and the zone each one crosses

#	Tactic	ATT&CK	On the range	IEC 62443 zone
1	Initial access	T1566.001 Phishing: spearphishing attachment	The macro document arrives and the user opens it.	Enterprise
2	Execution	T1204.002 User execution: malicious file	WINWORD spawns powershell with an encoded command.	Enterprise
3	Persistence	T1053.005 Scheduled task	A task named after a real update job re-runs the loader hourly.	Enterprise
4	Command and control	T1071.001 Application layer protocol: web	Regular small POSTs to a content-delivery lookalike.	Enterprise
5	Exfiltration	T1041 Exfiltration over C2 channel	Finance documents leave in chunks over the same channel.	Enterprise

Zones in this run: Enterprise (Purdue level 4/5, via Internet mail and web egress); Identity (Purdue level 4, via LDAP and Kerberos to the domain controllers). How the zone model is used.

The alerts the SIEM raises from this run

Office application spawned a shell
WINWORD.EXE or EXCEL.EXE as the parent of powershell.exe or cmd.exe.
endpoint agent · stage 2 · LINE-MISSIONS-01 · T1204.002
Scheduled task registered outside a change window
Task registration by a user account with no change record.
endpoint agent · stage 3 · LINE-MISSIONS-02 · T1053.005
Beacon cadence to a young domain
Same-size POSTs at a regular interval with low jitter.
network sensor · stage 4 · LINE-MISSIONS-03 · T1071.001

What the case has to hold before it closes

The delivered message, its hash and the mailbox it reached
The process tree from the document to the loader
The persistence artifact and where it lives
The destination, the interval and the volume that left

Start learning this line

One attachment to data out the door, triaged from the estate's own alert queue.

Start the lab

A tick means the other platform's own documentation shows it. A question mark means we could not confirm it publicly — it is never a claim that they lack it. Every Forge yes opens the working screen rather than a screenshot.