Skip to main content
27 Oct – 2 Nov 2026

Haunted SOC

A Haunted triage every day, four operations on 27 Oct and a special one on Halloween.

Join with a free accountLog inYour SOCSimulator account is your entry. No separate registration.

Case files

  1. Tue 27 Oct

    Tue27OctCase 01Overnight Sign-In Burst: Failed Logons Across the DirectoryOpen case ›Case 02Lock Screen Binary and Three Images: A Claims Workstation AlertOpen case ›Case 03Two Signed Remote Support Agents: An Advisory Workstation AlertOpen case ›Case 04Passkey Rollout: A New Sign-In Method on a Claims AccountOpen case ›
    Haunted triageOne alert, one verdict

    Case 01Thousands of knocks in a single night, nearly every one refused. Password spraying is one of the most common ways into a company this year. Decide whether anyone got in.

    Case 02Like every vampire, it only gets in if you invite it. Paste-and-run lures were the threat SOCs met most often this year. Three pictures and one signed system file are waiting for you.

    Case 03Two remote support tools, both signed, both installed the same afternoon. Is it IT, or something wearing IT's face? Remote tool abuse is among the intrusions SOCs handle most this year.

    Case 04A friendly call about the passkey rollout. A new sign-in method on the account an hour later. Voice phishing is rising fast this year, and the voice always sounds familiar.

  2. Wed 28 Oct

    Wed28Oct
    Haunted triageOne alert, one verdict

  3. Thu 29 Oct

    Thu29Oct
    Haunted triageOne alert, one verdict

  4. Fri 30 Oct

    Fri30Oct
    Haunted triageOne alert, one verdict

  5. Sat 31 Oct

    Sat31OctCase 05 · SpecialEndpoint Sensor Goes Quiet: A Management Server AlertOpen case ›
    Haunted triageOne alert, one verdict

    Case 05 · SpecialThe busiest ransomware crew of the season minds its manners. It always leaves a polite note at the end. Make sure it never gets that far.

  6. Sun 1 Nov

    Sun1Nov
    Haunted triageOne alert, one verdict

  7. Mon 2 Nov (today)

    Mon2NovToday
    Haunted triageOne alert, one verdictSign up to take it ›

The rulesA candle lights each day at midnight UTC. What's lit can be opened.

A special drop of operations, chosen from the threats that spooked SOCs most this year. Four drop on Tue 27 Oct, and the special operation on Sat 31 Oct. Plus the Haunted triage: a new case every day from Tue 27 Oct to Mon 2 Nov.