Skip to main content
Add to calendarManage team

It’s Downtime!

22nd to 26th Oct. Join any day. Simulator-Led CTF Event.

Bring a team, or brave it solo, to find out what’s really going on inside a haunted network. Built for blue team defensive practitioners of any level, with prizes for top players.

Add to calendarManage team

Strange & Unusual ActivityStrange & Unusual ActivityStrange & Unusual Activitysay it three times and it shows up in your logs

Strange & Unusual Activity Detected

Congratulations, you’ve been assigned the case! A crew called Pinstripe Moth has crashed a game studio’s network, swiped the unreleased build and moved in. The help desk has filed it under "paranormal".

The event is open from 22 to 26 October. No waiting room, no taking a number, join the challenge at any time and play at your own pace.

Bring your team and make it this month’s official training. Strange and unusual colleagues especially welcome. Playing solo is possible but harder, since the challenges test different practitioner skills.

Leaderboard prizes go to the top-scoring teams, while raffle prizes are drawn from individual tickets: you earn one for every challenge you complete, wherever your team ranks.

  • Alert Triaging
  • Digital Forensics
  • Threat Hunting
  • Malware Analysis

  • Join for FREE

    Junior to manager, anyone can join!

  • Real-world Simulators

    Put your defensive skills to the test

  • Rewards

    Win prizes worth over $40,000

  • Certificate

    Earn an official proof of your skill set

Things are about to get strange...Here’s what’s waiting for you inside the challenge

Hands-on practice in the skills security teams rely on most: alert triage, threat hunting, incident response and digital forensics.

  1. SOC Simulator(opens in a new tab)

    Estimated Time ~1h

    Triage realistic alerts in a SIEM, separate real threats from false positives, escalate what matters and write up each case. Get every alert right to pass.

    Best done in a team

  2. Threat Hunting Simulator(opens in a new tab)

    Estimated Time ~3h

    Test a hunting hypothesis, follow threat intel leads through the logs, rebuild the attack chain and work out how far it spread.

    Best done in a team

  3. Tabletop Exercise(opens in a new tab)

    Estimated Time ~1h

    Handle a growing incident as a team: agree priorities, communicate under pressure and keep the business running. See where your process falls short.

    Best done in a team

  4. 5 CTF Challenges

    Estimated Time ~3h

    Trace attacker activity through Windows event logs and Sysmon, map it to MITRE ATT&CK and recover evidence from file system records.

    Best done in a team

FAQs

  • What is Strange & Unusual Activity?

    A free, team-based defensive security CTF from TryHackMe. Your team works one connected incident at a game studio under attack, through a SOC Simulator, a Threat Hunting Simulator, a tabletop exercise and five CTF challenges.

  • When does it run?

    From 4pm GMT (16:00 UTC) on Thursday 22 October 2026 until midnight GMT at the end of Monday 26 October. Join on any day in that window.

  • How long does it take?

    A few hours of hands-on time, split however your team likes across the five days. As a guide: about 30 minutes for the SOC Sim, 45 to 60 for the hunt, 3 to 4 hours for the five CTF challenges, and about 30 minutes for the tabletop.

  • How much does it cost?

    Nothing. You need a TryHackMe account, and a free one is enough. The simulators are normally part of TryHackMe for Business.

  • How does scoring work?

    The leaderboard ranks teams. Each CTF challenge scores its normal points (450 in total), and each simulator and the tabletop add 500 points once per team, as soon as any one member passes. Failed runs score nothing.

  • How do raffle tickets work?

    Tickets are personal: you earn one ticket for every challenge you complete yourself (for the simulators and the tabletop, that means a pass), even if a teammate already scored it for the team. Watching the manager webinar earns 2 extra tickets. The more you finish, the more chances you get.

  • How is the winner decided?

    The team with the highest score when the event closes on 26 October wins. If two teams tie, the one that completed first ranks higher. There are no first-blood bonuses.

  • What can we win?

    Over $40,000 in prizes: leaderboard prizes for the top teams, plus raffle prizes for everyone who earns tickets. The full prize list is on the event page.

  • Do I get a certificate?

    Yes. Everyone who takes part gets a personal certificate of completion once their team completes the event.

  • Who is it for?

    Defensive practitioners across the blue team: SOC analysts, threat hunters, incident responders and detection engineers. The content is built for working practitioners and is meant to be challenging.

  • Do I need a team?

    Yes, but a team of one counts. The event is built for teams and playable solo; your progress counts once you’re in a team.

  • How big can a team be?

    Up to 20 people.

  • Can I be in more than one team?

    No, one team at a time.

  • Can colleagues from other companies or regions join my team?

    Yes. Points follow the team, not the employer, and colleagues in other regions and departments join for free.

  • I manage a security team. Why should we take part?

    Your team works one shared incident from first alert to final response. You see who leads, who spots what and where handovers break, without real-world fallout.

  • Is there anything for managers?

    A short online session for security managers on Monday 26 October; the topic, speaker and time are on the event page. The recording goes out after the event, and players can send their manager a ready-made email from the event page.

  • Will my company’s name be on the leaderboard?

    No. The leaderboard shows team names, so your company only appears if you name your team after it.

  • Can I keep playing the simulators after 26 October?

    The free event access ends when the event closes, and the scenarios go back to TryHackMe for Business plans.

  • When are winners announced?

    Winners are confirmed after the event closes on 26 October.

Dig up your team’s capability gaps before something darker does

This is TryHackMe for Business: practise against the horrors haunting your organisation, prove your team’s ready, and sharpen your defenses until nothing’s left hiding. Now including the Live Breach incident response cyber range.

Explore TryHackMe for Business

  • Live Breach Simulator

    Drill incident response against a fully executed attack. Pick the SIEM and EDR, then watch how your team faces the fear.

    Explore Live Breach Simulator

  • Tailored CTFs

    Unleash a live competition with fresh, in-house challenges. No walkthroughs waiting in the dark.

    Explore Tailored CTFs

  • Tabletops & Simulators

    Practise triage, threat hunting and decisions on live scenarios. Exorcise what’s lurking in your team’s response before the stakes rise.

    Explore Tabletops & Simulators