Akira Ransomware: Full Kill Chain IR
Trace a ransomware deployment from initial access through lateral movement to data exfiltration across SIEM, XDR, and Firewall.
1h·150
Start operationSOCSimulator: SOC analyst training, under real pressure.
SOCSimulator is a Security Operations Center training platform where you practice alert triage, incident investigation, and threat analysis using realistic SIEM, XDR, and Firewall interfaces. Built for career-switchers, security teams, students, and bootcamps, it provides hands-on experience with production-modeled security tools and MITRE ATT&CK-mapped scenarios drawn from the current threat landscape. No prior security experience required, and there is a free tier with no credit card.
Investigate real intrusions inside production-style SIEM, XDR, and Firewall consoles, working from the same live data a SOC sees. Built for cybersecurity learners, security teams, and classrooms.
No credit card needed to start.
Three ways to train on real, current attacks.
Everything here is built on the actual, current threat landscape: real attack patterns, real indicators of compromise, and real techniques.
Why it works
Every operation rebuilds a real breach from its published telemetry. You investigate the actual evidence in the consoles shown here, and every answer has to hold up against it.
C:\Windows\system32\services.exe02:14:07
[820]svchost.exe(system)02:14:09
C:\Windows\system32\svchost.exe -k netsvcs -p
[3924]anydesk.exe(SYSTEM)02:19:33
C:\ProgramData\AnyDesk\anydesk.exe --service
[5188]powershell.exe(CORP\adm-backup)Suspicious02:31:02
Get-WmiObject Win32_ShadowCopy | ForEach { $_.Delete() }
[5410]akira.exe(CORP\adm-backup)Suspicious02:33:18
C:\Temp\akira.exe -p \\FS01\finance
SHA-256 9c2ab417f0d38c5e21b06f44a8d17e93c05b12aa34fe6d78b90c14e2d5a67f31
Scattered Spider: Identity-First Attack ChainBlack Basta: Email Bomb to EncryptionFake Zoom to Ransomware: The Social Engineering PipelineCloud Token Theft: Identity Under SiegeKerberoasting: Service Ticket to Domain AdminEvilginx AiTM: Session Cookie HijackCI/CD Pipeline Hijack: GitHub Actions CompromiseCobalt Strike: Beacon DetectionMFA Fatigue: The Notification FloodQR Code Phishing: Scan to CompromiseCredential Harvesting: The Lookalike Login
New operations drop every week, built on the current threat landscape.
Browse all operations
7h·590 XP
SOC Analyst Foundations
View trackYour first week on the job: phishing, credential theft, and social engineering basics. Learn to investigate the initial access vectors every SOC analyst sees on day one.
Beginner
5h·1465 XP
2026 Infostealers: The Stealer-Log Economy
View trackWork the infostealer families actually active in 2026 - Lumma, Vidar 2.0, StealC, and the macOS stealer AMOS - from the lure that drops them to the single stolen log that takes down an enterprise.
Intermediate
Coming soon
Coming soon
Coming soon
Coming soon
Two tracks are available today, with more releasing soon on 2026 threats.
Coming soon.
Shift Mode is launching soon.
Operations and Tracks are available today.
Watch your competence become measurable.
Every triage decision you make is scored across eight analyst competencies, so your progress is something you can see, not guess at.
Triage speed and accuracy. How fast you respond and how often you classify true vs false positives correctly.
Cross-tool correlation. Linking related signals across SIEM, XDR, and Firewall into one coherent picture.
Investigation methodology. Following the runbook, documenting findings, and holding up under pressure.
Weak spots and strengths both show, and every operation pushes the web a little further out. It is one example, not an average. The more reps you put in, the faster it grows.
Competency Radar
8-dimension professional competency assessment
Simple pricing.
Free to start, upgrade when ready. Pro for unlimited operations and Shift Mode. Enterprise for teams. Full comparison on the pricing page.
Free
$0no credit card needed
- Hands-on operations
- SIEM, XDR, Firewall consoles
- Progress tracking
Prefer to pay once? Lifetime Pro is $299 one-time. Get lifetime access
30-day money-back guarantee. Cancel anytime.
See the full comparisonQuestions, answered.
What aspiring SOC analysts ask before they start training.
Yes, genuinely free, not a trial. You get real beginner walkthroughs, three tool consoles, and progress tracking with no credit card. Pro adds Shift Mode and unlimited rooms when you're ready.
Ready to start? Create your free account
Sharpen your skills
on real attacks.
Measurable SOC training on the current threat landscape. Free to start.
No credit card needed to start.
Built for teams and classrooms, too.
The same hands-on operations that get individuals hired also help companies sharpen their analysts and let educators run a real SOC lab, with zero infrastructure to set up.
For business
Measurable SOC training, mapped to the standards you answer to.
Give your team realistic reps on the attacks they actually face, and turn training into evidence: verifiable skill progression and framework coverage you can put in front of auditors.
- Team dashboards with measurable per-analyst progress
- Operations mapped to MITRE ATT&CK® and the tools your SOC runs
- Attestations that support audits against international standards
For education
Give students the shift, not just the slides.
Bring hands-on, job-relevant training to your university, bootcamp, or course. Assign operations, follow progress in a teaching dashboard, and review real investigations, with no lab to build or maintain.
- Assignments and class management
- Measure every student's progress and competency
- Curriculum-ready operations, nothing to set up
