Forge Workshop

Build detections and automation that actually run, then break them.

Open the workshop Every line side by side

What is in it

For detection engineer, automation engineer — ship reliable detections and playbooks, and recover when a connector fails.

Executable SOAR playbooks: draft, run, fail, repair, rerun
Deterministic integration faults and idempotent retries
A run debugger showing resolved inputs, outputs, errors and retries
Detection rules tested against positive and benign fixtures

What it is not

Playbooks run against the simulated estate, not your production tools
Not a commercial SOAR product you would deploy

Forge Workshop against the field

15 capabilities that matter for this purchase, next to the platforms a buyer shortlists in this lane: Immersive, RangeForce, TryHackMe.

Playbooks genuinely execute against the estate — draft, run, fail on a staged connector fault, repair, rerun.
A run debugger shows resolved inputs, outputs, errors and retries rather than a pass mark.
Detections are tested against benign fixtures as well as positives, so a noisy rule fails.

The run behind this line: Write the search that catches the persistence

A detection-engineering bench: the persistence is already planted, and the deliverable is a search that finds it without drowning in noise.

Opponent: Quiet operator relying on names that look like real software. Shaped after Persistence tradecraft documented across ATT&CK T1547, T1543 and T1053. Technique and zone identifiers are published by MITRE and ISA/IEC; the mapping is ours and is not an accreditation.

How it starts — the message delivered to the mailbox

From: Microsoft 365 Message Center <messagecenter@m365-notices.example>
Subject: Action required: OneDrive sync client update for your device
Attachment: OneDriveSyncUpdate.lnk (Windows shortcut)

A shortcut file posing as an updater
A vendor notice sent from a domain the vendor does not own
The get-out clause at the end, added so the reader does not ask IT

Graded verdict: phish — T1566.001. Nothing here sends or resolves anywhere real.

The steps, and the zone each one crosses

#	Tactic	ATT&CK	On the range	IEC 62443 zone
1	Initial access	T1566.001 Phishing: spearphishing attachment	The shortcut runs the loader and writes it to ProgramData.	Enterprise
2	Persistence	T1547.001 Registry Run key	A Run value named OneDriveSync points at C:\ProgramData\rt.exe.	Enterprise
3	Persistence	T1543.003 Windows service	A service called WinTelemetrySvc is installed and started.	Enterprise
4	Persistence	T1053.005 Scheduled task	taskeng launches a hidden PowerShell script from ProgramData.	Enterprise

Zones in this run: Enterprise (Purdue level 4/5, via Internet mail and web egress); Identity (Purdue level 4, via LDAP and Kerberos to the domain controllers). How the zone model is used.

The alerts the SIEM raises from this run

Run key written to a user-writable path
HKCU Run value whose data points at ProgramData, Temp or AppData.
endpoint agent · stage 2 · LINE-WORKSHOP-01 · T1547.001
Service installed with a suspicious image path
7045 where the image path is outside Program Files or System32.
endpoint agent · stage 3 · LINE-WORKSHOP-02 · T1543.003
Hidden PowerShell launched by the task engine
taskeng.exe or svchost as the parent of powershell -w hidden.
endpoint agent · stage 4 · LINE-WORKSHOP-03 · T1053.005

What the case has to hold before it closes

The search that finds all three persistence mechanisms
The false-positive rate the search produces against the clean estate
The artifact each hit points at
The removal steps, in an order that does not destroy the evidence

Start learning this line

Build the detection and the playbook on the bench, compiled by the same engine the graded cases run.

Start the labThen run the campaign

A tick means the other platform's own documentation shows it. A question mark means we could not confirm it publicly — it is never a claim that they lack it. Every Forge yes opens the working screen rather than a screenshot.

What you need	Forge WorkshopIncluded in the platform	THM	RangeForce	Immersive
SOC investigation exercise	Yes See it live	TryHackMe: Documented for SOC investigation exercise	RangeForce: Documented for SOC investigation exercise	Immersive: Documented for SOC investigation exercise
Alert triage with true and false positive decisions	Yes See it live Every case ships with innocent lookalikes so closing everything scores badly.	TryHackMe: Documented for Alert triage with true and false positive decisions	RangeForce: Limited for Alert triage with true and false positive decisions	Immersive: Limited for Alert triage with true and false positive decisions
SIEM query and investigation practice	Yes See it live	TryHackMe: Documented for SIEM query and investigation practice	RangeForce: Documented for SIEM query and investigation practice	Immersive: Documented for SIEM query and investigation practice
Endpoint analysis and access	Yes See it live	TryHackMe: Limited for Endpoint analysis and access	RangeForce: Documented for Endpoint analysis and access	Immersive: Limited for Endpoint analysis and access
Threat hunting kept separate from alert triage	Yes See it live	TryHackMe: Documented for Threat hunting kept separate from alert triage	RangeForce: Documented for Threat hunting kept separate from alert triage	Immersive: Documented for Threat hunting kept separate from alert triage
Investigation that crosses multiple tools	Yes See it live One estate behind SIEM, EDR, case service, network devices and the wire.	TryHackMe: Documented for Investigation that crosses multiple tools	RangeForce: Documented for Investigation that crosses multiple tools	Immersive: Documented for Investigation that crosses multiple tools
Analyst report or evidence submission	Yes See it live	TryHackMe: Documented for Analyst report or evidence submission	RangeForce: Documented for Analyst report or evidence submission	Immersive: Documented for Analyst report or evidence submission
Measured investigation and response timing	Yes See it live Dwell time, containment time and SLA clocks are scored, not just recorded.	TryHackMe: Documented for Measured investigation and response timing	RangeForce: Documented for Measured investigation and response timing	Immersive: Documented for Measured investigation and response timing
Detection-engineering curriculum	Yes See it live	TryHackMe: Documented for Detection-engineering curriculum	RangeForce: Documented for Detection-engineering curriculum	Immersive: Documented for Detection-engineering curriculum
SOAR concepts and workflow training	Yes See it live	TryHackMe: Limited for SOAR concepts and workflow training	RangeForce: Limited for SOAR concepts and workflow training	Immersive: Documented for SOAR concepts and workflow training
Learner authors an executable SOAR playbookDeliberately stricter than the row above: a SOAR-looking screen is not a runtime.	Yes See it live Draft, run, fail, repair and rerun against the live estate, with an audit trail.			Immersive: Documented for Learner authors an executable SOAR playbook
Connector failure and replay debugger for automation	Yes See it live Deterministic integration faults with idempotent retries. Not established for any vendor in the research.
Configuration changes alter the exercise	Yes See it live Firewall, routing and policy edits change what the wire and the SIEM then show.	TryHackMe: Limited for Configuration changes alter the exercise	RangeForce: Documented for Configuration changes alter the exercise	Immersive: Documented for Configuration changes alter the exercise
Rogue access point owned by the estate, not scripted	Yes See it live
Each scenario carries its own SIEM, alerts and case databaseNo shared global console: an alert raises a case on the estate it came from, and cannot leak into another team's exercise.	Yes See it live	TryHackMe: Limited for Each scenario carries its own SIEM, alerts and case database