Cybrary ForgeCYBRARY / FORGE
Back to Cybrary Forge

Training room

One station per step of a breach response. Run the lab, then make the call. The coach scores both halves and tells you what to do next. Defender playbook · the plan with real clocks.

New to this? Foundations explains alerts, cases, attack steps and plant zones in plain words. Analyst vocabulary gives the same ground with ATT&CK and IEC 62443 identifiers.

Want it in order? The security operations course runs nine modules across three units — plant zones and conduits (IEC 62443), the attacker steps ATT&CK names, and how a SIEM turns log records into alerts and a case.

New: AI for Security Operations and AI Governance, Risk & Compliance — hands-on labs where you check AI drafts, plus governance theory modules.

Security operations course

9 modules · about 115 minutesCourse index

Unit 1 — Plant zones and conduits

Unit 2 — Attacker steps

Unit 3 — SIEM alerts and cases

IEC 62443 course

11 modules · 4 graded assessments · about 124 minutes of readingCourse index

Going deeper on the plant standard: zones and conduits, the security level and protection profile a zone is held to, how a detection becomes evidence for a foundational requirement, and how a breach is worked without making the plant less safe. Each unit ends with a graded assessment, passed at 75%.

Unit 1 — Zones, conduits and levels

Unit 2 — Security levels and protection profiles

Unit 3 — Detections as evidence

Unit 4 — Working a breach without breaking the plant

Coach score

0
starting
decisions 0 · hands-on 0 · ready at 85

Next: Answer the decision drill for “Notice it”.

  • 8 stations still unplayed: Notice it, Confirm it, Cut the machine off, Close the route, Keep the evidence, Remove the access, Put it back, Write it down.
  • 8 decision drills not answered yet.
  • No live runs yet — the coach cannot see your clock.

SOAR drills

00 of 144 playbook steps called right across 12 techniques · passing is 80

Every step of a response playbook is one of four things: it runs by itself, a responder does it, it branches on an answer, or it waits on somebody with the authority to say yes. Call each one, then run the same playbook against a live breach in the SOAR console and check it on the breach timeline.

Next: the playbook for T1566.002.

  • T1566.002

    Phishing: Spearphishing Link

    Initial Access · 0 of 12 rightopen this playbook on a live run

    • "Enrich the alert" — what kind of step is this, and how does it run?

    • "Verify the signal on a second source" — what kind of step is this, and how does it run?

    • "Real incident, or not?" — what kind of step is this, and how does it run?

    • "Scope it across the estate" — what kind of step is this, and how does it run?

    • "Find first seen, and how they got in" — what kind of step is this, and how does it run?

    • "Approve containment" — what kind of step is this, and how does it run?

    • "Contain" — what kind of step is this, and how does it run?

    • "Block the path everywhere else" — what kind of step is this, and how does it run?

    • "Remove it" — what kind of step is this, and how does it run?

    • "Approve return to service" — what kind of step is this, and how does it run?

    • "Restore and verify" — what kind of step is this, and how does it run?

    • "Write the record" — what kind of step is this, and how does it run?

  • T1204.001

    User Execution: Malicious Link

    Execution · 0 of 12 rightopen this playbook on a live run

    • "Enrich the alert" — what kind of step is this, and how does it run?

    • "Verify the signal on a second source" — what kind of step is this, and how does it run?

    • "Real incident, or not?" — what kind of step is this, and how does it run?

    • "Scope it across the estate" — what kind of step is this, and how does it run?

    • "Find first seen, and how they got in" — what kind of step is this, and how does it run?

    • "Approve containment" — what kind of step is this, and how does it run?

    • "Contain" — what kind of step is this, and how does it run?

    • "Block the path everywhere else" — what kind of step is this, and how does it run?

    • "Remove it" — what kind of step is this, and how does it run?

    • "Approve return to service" — what kind of step is this, and how does it run?

    • "Restore and verify" — what kind of step is this, and how does it run?

    • "Write the record" — what kind of step is this, and how does it run?

  • T1078

    Valid Accounts

    Defense Evasion · 0 of 12 rightopen this playbook on a live run

    • "Enrich the alert" — what kind of step is this, and how does it run?

    • "Verify the signal on a second source" — what kind of step is this, and how does it run?

    • "Real incident, or not?" — what kind of step is this, and how does it run?

    • "Scope it across the estate" — what kind of step is this, and how does it run?

    • "Find first seen, and how they got in" — what kind of step is this, and how does it run?

    • "Approve containment" — what kind of step is this, and how does it run?

    • "Contain" — what kind of step is this, and how does it run?

    • "Block the path everywhere else" — what kind of step is this, and how does it run?

    • "Remove it" — what kind of step is this, and how does it run?

    • "Approve return to service" — what kind of step is this, and how does it run?

    • "Restore and verify" — what kind of step is this, and how does it run?

    • "Write the record" — what kind of step is this, and how does it run?

  • T1552.001

    Unsecured Credentials: Credentials In Files

    Credential Access · 0 of 12 rightopen this playbook on a live run

    • "Enrich the alert" — what kind of step is this, and how does it run?

    • "Verify the signal on a second source" — what kind of step is this, and how does it run?

    • "Real incident, or not?" — what kind of step is this, and how does it run?

    • "Scope it across the estate" — what kind of step is this, and how does it run?

    • "Find first seen, and how they got in" — what kind of step is this, and how does it run?

    • "Approve containment" — what kind of step is this, and how does it run?

    • "Contain" — what kind of step is this, and how does it run?

    • "Block the path everywhere else" — what kind of step is this, and how does it run?

    • "Remove it" — what kind of step is this, and how does it run?

    • "Approve return to service" — what kind of step is this, and how does it run?

    • "Restore and verify" — what kind of step is this, and how does it run?

    • "Write the record" — what kind of step is this, and how does it run?

  • T1555

    Credentials from Password Stores

    Credential Access · 0 of 12 rightopen this playbook on a live run

    • "Enrich the alert" — what kind of step is this, and how does it run?

    • "Verify the signal on a second source" — what kind of step is this, and how does it run?

    • "Real incident, or not?" — what kind of step is this, and how does it run?

    • "Scope it across the estate" — what kind of step is this, and how does it run?

    • "Find first seen, and how they got in" — what kind of step is this, and how does it run?

    • "Approve containment" — what kind of step is this, and how does it run?

    • "Contain" — what kind of step is this, and how does it run?

    • "Block the path everywhere else" — what kind of step is this, and how does it run?

    • "Remove it" — what kind of step is this, and how does it run?

    • "Approve return to service" — what kind of step is this, and how does it run?

    • "Restore and verify" — what kind of step is this, and how does it run?

    • "Write the record" — what kind of step is this, and how does it run?

  • T1114.003

    Email Collection: Email Forwarding Rule

    Collection · 0 of 12 rightopen this playbook on a live run

    • "Enrich the alert" — what kind of step is this, and how does it run?

    • "Verify the signal on a second source" — what kind of step is this, and how does it run?

    • "Real incident, or not?" — what kind of step is this, and how does it run?

    • "Scope it across the estate" — what kind of step is this, and how does it run?

    • "Find first seen, and how they got in" — what kind of step is this, and how does it run?

    • "Approve containment" — what kind of step is this, and how does it run?

    • "Contain" — what kind of step is this, and how does it run?

    • "Block the path everywhere else" — what kind of step is this, and how does it run?

    • "Remove it" — what kind of step is this, and how does it run?

    • "Approve return to service" — what kind of step is this, and how does it run?

    • "Restore and verify" — what kind of step is this, and how does it run?

    • "Write the record" — what kind of step is this, and how does it run?

  • T1564.008

    Email Hiding Rules

    Defense Evasion · 0 of 12 rightopen this playbook on a live run

    • "Enrich the alert" — what kind of step is this, and how does it run?

    • "Verify the signal on a second source" — what kind of step is this, and how does it run?

    • "Real incident, or not?" — what kind of step is this, and how does it run?

    • "Scope it across the estate" — what kind of step is this, and how does it run?

    • "Find first seen, and how they got in" — what kind of step is this, and how does it run?

    • "Approve containment" — what kind of step is this, and how does it run?

    • "Contain" — what kind of step is this, and how does it run?

    • "Block the path everywhere else" — what kind of step is this, and how does it run?

    • "Remove it" — what kind of step is this, and how does it run?

    • "Approve return to service" — what kind of step is this, and how does it run?

    • "Restore and verify" — what kind of step is this, and how does it run?

    • "Write the record" — what kind of step is this, and how does it run?

  • T1059.001

    Command and Scripting Interpreter: PowerShell

    Execution · 0 of 12 rightopen this playbook on a live run

    • "Enrich the alert" — what kind of step is this, and how does it run?

    • "Verify the signal on a second source" — what kind of step is this, and how does it run?

    • "Real incident, or not?" — what kind of step is this, and how does it run?

    • "Scope it across the estate" — what kind of step is this, and how does it run?

    • "Find first seen, and how they got in" — what kind of step is this, and how does it run?

    • "Approve containment" — what kind of step is this, and how does it run?

    • "Contain" — what kind of step is this, and how does it run?

    • "Block the path everywhere else" — what kind of step is this, and how does it run?

    • "Remove it" — what kind of step is this, and how does it run?

    • "Approve return to service" — what kind of step is this, and how does it run?

    • "Restore and verify" — what kind of step is this, and how does it run?

    • "Write the record" — what kind of step is this, and how does it run?

  • T1003.001

    OS Credential Dumping: LSASS Memory

    Credential Access · 0 of 12 rightopen this playbook on a live run

    • "Enrich the alert" — what kind of step is this, and how does it run?

    • "Verify the signal on a second source" — what kind of step is this, and how does it run?

    • "Real incident, or not?" — what kind of step is this, and how does it run?

    • "Scope it across the estate" — what kind of step is this, and how does it run?

    • "Find first seen, and how they got in" — what kind of step is this, and how does it run?

    • "Approve containment" — what kind of step is this, and how does it run?

    • "Contain" — what kind of step is this, and how does it run?

    • "Block the path everywhere else" — what kind of step is this, and how does it run?

    • "Remove it" — what kind of step is this, and how does it run?

    • "Approve return to service" — what kind of step is this, and how does it run?

    • "Restore and verify" — what kind of step is this, and how does it run?

    • "Write the record" — what kind of step is this, and how does it run?

  • T1021.002

    SMB/Windows Admin Shares

    Lateral Movement · 0 of 12 rightopen this playbook on a live run

    • "Enrich the alert" — what kind of step is this, and how does it run?

    • "Verify the signal on a second source" — what kind of step is this, and how does it run?

    • "Real incident, or not?" — what kind of step is this, and how does it run?

    • "Scope it across the estate" — what kind of step is this, and how does it run?

    • "Find first seen, and how they got in" — what kind of step is this, and how does it run?

    • "Approve containment" — what kind of step is this, and how does it run?

    • "Contain" — what kind of step is this, and how does it run?

    • "Block the path everywhere else" — what kind of step is this, and how does it run?

    • "Remove it" — what kind of step is this, and how does it run?

    • "Approve return to service" — what kind of step is this, and how does it run?

    • "Restore and verify" — what kind of step is this, and how does it run?

    • "Write the record" — what kind of step is this, and how does it run?

  • T1580

    Cloud Infrastructure Discovery

    Discovery · 0 of 12 rightopen this playbook on a live run

    • "Enrich the alert" — what kind of step is this, and how does it run?

    • "Verify the signal on a second source" — what kind of step is this, and how does it run?

    • "Real incident, or not?" — what kind of step is this, and how does it run?

    • "Scope it across the estate" — what kind of step is this, and how does it run?

    • "Find first seen, and how they got in" — what kind of step is this, and how does it run?

    • "Approve containment" — what kind of step is this, and how does it run?

    • "Contain" — what kind of step is this, and how does it run?

    • "Block the path everywhere else" — what kind of step is this, and how does it run?

    • "Remove it" — what kind of step is this, and how does it run?

    • "Approve return to service" — what kind of step is this, and how does it run?

    • "Restore and verify" — what kind of step is this, and how does it run?

    • "Write the record" — what kind of step is this, and how does it run?

  • T1530

    Data from Cloud Storage

    Collection · 0 of 12 rightopen this playbook on a live run

    • "Enrich the alert" — what kind of step is this, and how does it run?

    • "Verify the signal on a second source" — what kind of step is this, and how does it run?

    • "Real incident, or not?" — what kind of step is this, and how does it run?

    • "Scope it across the estate" — what kind of step is this, and how does it run?

    • "Find first seen, and how they got in" — what kind of step is this, and how does it run?

    • "Approve containment" — what kind of step is this, and how does it run?

    • "Contain" — what kind of step is this, and how does it run?

    • "Block the path everywhere else" — what kind of step is this, and how does it run?

    • "Remove it" — what kind of step is this, and how does it run?

    • "Approve return to service" — what kind of step is this, and how does it run?

    • "Restore and verify" — what kind of step is this, and how does it run?

    • "Write the record" — what kind of step is this, and how does it run?

The stations

  1. 01

    Notice it

    by standing

    Know what this estate normally carries, so the thing that is not normal stands out on its own.

    Open the labNot run yet — the station completes itself once you finish the lab.

    A finance workstation has been sending 4 MB an hour to a hosting provider, every hour, since Tuesday. Everything is HTTPS on port 443. Nothing has alerted.

    What makes this worth opening, when the traffic is allowed and the volume is small?

  2. 02

    Confirm it

    by 30 min

    Turn a signal into a sequence — who, on what, to where, in what order — before anyone is woken up.

    Open the labNot run yet — the station completes itself once you finish the lab.

    The beacon above is real. Your manager is asking whether to pull the machine off the network right now.

    What has to be true before you answer that question?

  3. 03

    Cut the machine off

    by 1 h

    Take the host out of reach without losing the evidence on it.

    Open the labNot run yet — the station completes itself once you finish the lab.

    You are isolating the finance workstation. It is running and the operator is active on it.

    Which action keeps both the containment and the case?

  4. 04

    Close the route

    by 2 h

    Deny the infrastructure, not just the one machine that used it.

    Open the labNot run yet — the station completes itself once you finish the lab.

    The workstation is isolated. The command destination is a single address at a hosting provider, resolved from a domain that changes every few days.

    What do you block?

  5. 05

    Keep the evidence

    by 4 h

    Take the copies that stop existing the moment you start cleaning up.

    Open the labNot run yet — the station completes itself once you finish the lab.

    Cleanup starts in ten minutes. Logs on this host roll every 24 hours.

    Which of these is the one that cannot be recovered later?

  6. 06

    Remove the access

    by 1 d

    Take away every way back in, not only the one you found first.

    Open the labNot run yet — the station completes itself once you finish the lab.

    You removed a service the operator installed and deleted their scheduled task. The account they used is a service account with a password last changed in 2021.

    What is still outstanding?

  7. 07

    Put it back

    by 2 d

    Return service from a point you can prove is clean, and check it before the business uses it.

    Open the labNot run yet — the station completes itself once you finish the lab.

    The file server has to be back by morning. Your most recent recovery point is from four hours ago — two hours after the first confirmed operator activity.

    Which recovery point do you use?

  8. 08

    Write it down

    by 3 d

    Leave a record the next responder, the auditor and the business can all use.

    Open the labNot run yet — the station completes itself once you finish the lab.

    The incident is closed. You are writing it up the next morning.

    What makes the write-up worth the hour it takes?