The Shift: one SOC incident a day
Every day, the same incident for everyone. Investigate the artifacts, rebuild the kill chain, submit a verdict and share your result without giving the answers away.
Today: The Shift #47
9 November 2026 · Phishing and PowerShell
How it works
- Everyone plays the same incident that day; it changes at midnight (Madrid time). The /incidente-del-dia link always goes to today’s.
- When you finish, “Share the result” copies one square per verdict question (🟩 right, 🟥 wrong), the timeline and your grade: it shows how you did without giving the answers away.
- Playing today’s shift adds to your streak of consecutive days. The streak is only kept in your browser: no account and nothing sent to us.
- With a full verdict (4 out of 4), you enter the leaderboard if you have an alias in your profile.
Previous shifts
- The Shift #46 · 8 November 2026 · RDP brute force
- The Shift #45 · 7 November 2026 · A USB stick with a .lnk
- The Shift #44 · 6 November 2026 · Web exploitation
- The Shift #43 · 5 November 2026 · A USB stick with a .lnk
- The Shift #42 · 4 November 2026 · Web exploitation
- The Shift #41 · 3 November 2026 · RDP brute force
- The Shift #40 · 2 November 2026 · Phishing and PowerShell
- The Shift #39 · 1 November 2026 · RDP brute force
- The Shift #38 · 31 October 2026 · RDP brute force
- The Shift #37 · 30 October 2026 · Phishing and PowerShell
- The Shift #36 · 29 October 2026 · Web exploitation
- The Shift #35 · 28 October 2026 · A USB stick with a .lnk
- The Shift #34 · 27 October 2026 · RDP brute force
- The Shift #33 · 26 October 2026 · Phishing and PowerShell
- The Shift #32 · 25 October 2026 · RDP brute force
- The Shift #31 · 24 October 2026 · Phishing and PowerShell
- The Shift #30 · 23 October 2026 · A USB stick with a .lnk
- The Shift #29 · 22 October 2026 · Web exploitation
- The Shift #28 · 21 October 2026 · A USB stick with a .lnk
- The Shift #27 · 20 October 2026 · Web exploitation
- The Shift #26 · 19 October 2026 · RDP brute force
- The Shift #25 · 18 October 2026 · Phishing and PowerShell
- The Shift #24 · 17 October 2026 · Web exploitation
- The Shift #23 · 16 October 2026 · A USB stick with a .lnk
- The Shift #22 · 15 October 2026 · Web exploitation
- The Shift #21 · 14 October 2026 · A USB stick with a .lnk
- The Shift #20 · 13 October 2026 · Phishing and PowerShell
- The Shift #19 · 12 October 2026 · RDP brute force
- The Shift #18 · 11 October 2026 · Phishing and PowerShell
- The Shift #17 · 10 October 2026 · RDP brute force