The Threat Hunting World Championship is back — bigger, bolder, and with more on the line than ever. Sentinels League 2026, presented by SentinelOne® in partnership with DropZone AI, Google Cloud, and Mimecast, now is open for entries, and the best threat hunters on the planet are already sharpening their edge.

This year’s championship brings a new 30-minute game format, a $100,000 prize pool, and one of the most demanding tests in cybersecurity competition. If you hunt threats for a living, or you want to prove you can, this is where you belong.

Leagues Menu Quick Jump

• Americas League
• Asia League
• Europe League

What Is The Sentinels League?

Sentinels League is SentinelOne’s global threat hunting competition — a multi-stage championship that runs from June through October 2026, culminating live at OneCon in Las Vegas.

Every game is grounded in real-world attack patterns, real detection logic, and real operational pressure. Players go head-to-head across four games: Endpoint, Cloud, SIEM, and AI and capture flags of varying difficulty in high-intensity 30-minute qualifiers that test the exact skills defenders use in the field every day.

From June through August, qualifying games run online and in-person across the globe. The top 100 players per region then climb their Sentinels League standings and advance to the Regional Finals. Finally, three regional champions earn an all-expenses-paid trip to OneCon in Las Vegas for the Grand Final where one player is crowned Threat Hunting World Champion 2026.

Four Games. One Championship.

• Endpoint — Hunt down and remediate vulnerabilities in scenarios drawn directly from real incident data.
• Cloud — Track and eliminate threats across multi-clouds under time pressure.
• SIEM — Assert your detection dominance in real-time hunting and remediation challenges.
• AI — Go up against AI-generated threats and leverage AI-powered tools in scenarios built from the latest attack campaigns.

You can enter each game once across the qualifying season. Your combined score is what earns your place in the standings.

What You’re Playing For

Over $100,000 in prizes is distributed across every stage of the competition from the first qualifier through to the Grand Final.

In each online qualifier, payouts begin at first place and run all the way to 15th. First place takes $200, second takes $150, and the third, $100. Everyone from 4th to 15th walks away with $75. In total, there are 48 qualifiers in the season and every one of them pays.

Reach the Regional Finals and the stakes sharpen considerably. First place in your region is worth $2,500, with prizes distributed through to 15th place. For the three regional champions that make it to Las Vegas and the Grand Final, you’re competing for a $5,000 first prize, a portion donated to the charity of your choice through the S Foundation, and the trophy that belongs to only one person in the world.

The Road to Las Vegas

Qualifying Stage | June–August

Play each game once across 40+ online and in-person qualifiers across the globe and combine your scores. In this stage, the Top 200 per region will advance to Regionals.

Regional Finals | September

Tune in for the online showdown of the best hunters from each region — Americas, Europe, and Asia. From here, three regional champions progress to the Grand Final.

Grand Final at OneCon in Las Vegas | October

Three finalists, one stage. The World Champion is crowned live at OneCon26 and takes home the title, the trophy, and the grand prize.

Sentinels League Standings

Standings update weekly throughout the qualifying season. Bookmark this page and check back every week to track your climb and see who’s gunning for your spot. The Top 200 per region advance to the Regional Finals.

Americas League

Rank	Alias	Country	Played	Points
1	tresscross		4	1418
2	chiefkief		4	1315
3	staas		4	1235
4	BGrad		4	1150
5	GTNR		4	1095
6	ShinyShark		4	1026
7	JaredF		4	1018
8	DanielC		4	1009
9	WZRD404		4	998
10	nabiljain		4	982
11	Joshua_Eom		4	965
12	Evan		4	950
13	Justin		4	946
14	1-2-3-4		4	936
15	dk144		4	936
16	wardspan		4	880
17	riskybusiness		4	875
18	jydnx		4	873
19	jcob		4	864
20	theycallmetim		4	861
21	spookylukey		4	854
22	rhamiltontc		4	845
23	ifosterTC		4	835
24	ThreatSlayer		4	835
25	duotech		4	830
26	CmdrDataLake		4	822
27	j05h		4	785
28	Bumble_Fudger		4	765
29	Cwallis		3	759
30	smurph		4	752
31	0xf4d3		4	737
32	Robin-Banks		4	730
33	relogonm		4	726
34	maverick		4	721
35	alpal		4	720
36	MacLellan		4	710
37	vector_sec		4	706
38	khan		4	690
39	mr_bumbles		4	690
40	icy		4	685
41	AgroBoy		4	676
42	CyberSaiyan84		4	661
43	HiggsB		4	635
44	JeffLeder		4	626
45	hackerpanu		4	606
46	jmontalbano		4	600
47	4thelulz1		4	598
48	alevine		4	589
49	BAE_Force_1		4	580
50	OneManFirewall		4	580
51	ECOLI		4	545
52	DustyV		4	543
53	mmazis		4	542
54	ceraalorca		3	533
55	katze		4	533
56	Jen		4	528
57	SHWON		4	528
58	zerodavid		4	528
59	cybertricoteuse		4	521
60	HaircutFish		4	519
61	mgras		4	500
62	CmdnControl		4	495
63	Diasum		4	488
64	CyFi		2	485
65	Greavard		4	483
66	luminous_kestrel		4	478
67	Max		3	478
68	mandyjones		3	476
69	nmkoester		4	475
70	NateD		4	473
71	ProfessorNerdly		4	473
72	ninjacat		4	471
73	HikingHacker		4	466
74	Richieee		4	455
75	aavant		4	452
76	Xogarth		4	446
77	benthehen100		3	445
78	CanieXylander		3	445
79	Romulus		4	442
80	InfoSecBret		2	424
81	zero_cool		3	420
82	ElectricEel		4	419
83	sh3llder		2	410
84	BeanPipe		2	405
85	work_jpj		4	405
86	5h33pd06		4	404
87	CryptoCat		2	403
88	Stryker81		4	403
89	wadebuhr		4	403
90	rriegert		4	400
91	y1nmn		3	390
92	Average_Hunter		4	389
93	Cake		2	380
94	Ulric		4	380
95	Dharo		4	374
96	Spinja77		4	371
97	M1racle		4	370
98	mathecarv		1	365
99	JayHole		4	361
100	tytinz		4	361
101	Zer0d4y		4	347
102	dexterslab		4	343
103	SOCMonkeyz		4	341
104	Recovery13		3	340
105	slash		4	324
106	Nunya_Jones		4	321
107	___		2	320
108	GnomeMansLand		2	316
109	rob454		4	313
110	GreenApple404		4	311
111	SunnyShah		3	310
112	JessB		4	309
113	VoidStalker		4	308
114	mprof		4	294
115	Th3Gr33kDK		4	286
116	MngdAttribution		4	284
117	ahsan		4	279
118	Alakazam		3	275
119	PolloMax		3	273
120	Kucster		1	270
121	SilentByte		3	270
122	Nin		2	268
123	Demi		2	265
124	vesche		1	265
125	egg		4	263
126	Akill-X		2	260
127	Ovens		3	251
128	SN1ps		1	250
129	xenno		2	250
130	drpolloman		4	245
131	FlawlessCowboy		3	243
132	Antifuse		4	228
133	Dagon		4	227
134	alex		2	220
135	Miko		3	220
136	boy		2	218
137	handyC		2	218
138	LeonQ		4	215
139	topsirloin		3	215
140	Chef-P		2	211
141	noName		3	211
142	Brown33		1	208
143	RUDeadYet		4	206
144	GoldenSand		2	205
145	Bearzy		3	202
146	MRob		2	200
147	tmustache		1	200
148	alex1		3	195
149	bbaldini35		4	194
150	chris_w		1	193
151	pittbull_2026		2	192
152	Siegfried		4	192
153	EBlum		1	190
154	gstach		4	187
155	lazycatlady		4	181
156	yul10		4	181
157	domkrag		2	180
158	mr_rob0t404		3	180
159	Nerf		2	175
160	Rkermit		1	174
161	ZachsAlt		3	168
162	ctrlaltwho		4	166
163	zer0day		1	165
164	alexs		4	161
165	ammo		1	160
166	AGoat		1	159
167	Neeel		3	159
168	ekalmbacher		3	158
169	k1ng0fg0ds		3	158
170	alan		2	155
171	Magnar		4	155
172	paula_s		3	155
173	Delta01		2	151
174	FictionalSoup		1	151
175	efgh000		4	150
176	MoutainMan805		4	147
177	Gent		1	145
178	Kyle		1	145
179	Monsieur_Renegat		4	144
180	Trogon		2	143
181	frazzl3d		2	138
182	James_0		3	137
183	shredark		3	130
184	Jin-Sec_Enforcer		1	128
185	Cyber_Rich		1	126
186	bot		1	125
187	kevin		2	124
188	Alex		1	120
189	dusty_cheeto		1	120
190	Leah_Mnz		1	120
191	S0ra		2	120
192	TJSperry		1	120
193	go_cody		2	119
194	ProbablyBenign		1	115
195	ana7z		2	114
196	mrryan		3	114
197	ttbaba52		2	113
198	DVS1		2	110
199	Dohnut		4	108
200	KKonda		2	108
201	mnr		1	108
202	antomic		1	105
203	Loki		4	105
204	haxxortrax		2	103
205	paul		1	100
206	Andrewsro		4	98
207	Cyber_Cowboy		1	98
208	Bolap		1	96
209	Honu		1	94
210	aBryant		4	93
211	jh34		2	93
212	d4rkM4tt3r		4	91
213	Brute_Force		1	90
214	dbeal		2	90
215	Ocensnimer		2	85
216	james_graichen		4	83
217	foil		2	81
218	CarlosOwO		1	80
219	Drakonborn		1	80
220	Hossein		1	80
221	Imac		4	79
222	D-Money		3	76
223	G_Masala		4	76
224	jocyclara09		1	75
225	Cyril		1	73
226	Anunymous18		1	70
227	dmilutinovic		1	70
228	Flynn_Mota		1	70
229	JacobK		1	70
230	wcheung		1	70
231	BigRedCharlie		1	68
232	D3f1anT_Actual		1	68
233	jucai		2	68
234	eec1m		2	67
235	Vuldar		1	66
236	ByteBlossom		1	63
237	atthebagelshop		1	60
238	lamanteran		1	60
239	MikeyB		1	60
240	Conficker		3	59
241	glacier		4	59
242	Ak1895		1	58
243	s1moesz		1	58
244	SFIcedEdition		2	58
245	ShadowZero		1	58
246	bigheadted		3	57
247	goldfingerprints		2	57
248	Trace404		2	56
249	Godfotter		4	50
250	JDC		1	50
251	sclayton		1	50
252	sabalala		3	49
253	Al_Capwn		1	48
254	garfield		1	46
255	Gatekeeper		2	45
256	kswag		1	45
257	osayolb		1	45
258	R3yK0nG		2	45
259	nhs		3	44
260	J-S		1	43
261	CyberNeverQuits		1	42
262	Isabella_Plata		1	42
263	Tin1		2	42
264	psalmon		2	41
265	b6rim		1	40
266	Evimero		1	40
267	jarthurmesere		3	40
268	Bryce		1	38
269	Ethical_Danny		1	38
270	george_r		2	38
271	s0l3mn		1	38
272	Utefan-07		1	38
273	ashah		1	35
274	hue		1	35
275	joma67		2	35
276	MaddieChar		2	34
277	william		1	34
278	p0p0		2	33
279	sourabhdhawan		2	33
280	Abrie		2	30
281	rshrestha		1	30
282	codycodycody		1	28
283	gro		1	28
284	IronMouse		1	28
285	HYP3r1us		1	25
286	notnotmimi		1	25
287	AZNATTA		4	24
288	SOC-Hunter		2	23
289	gr3mlin		1	21
290	0xdecaf		1	20
291	dcastellanos		1	20
292	Mbonner		2	20
293	tumbleweed0101		1	20
294	Neo		1	19
295	0DAY		3	18
296	DOM_inject		1	18
297	hiddentek		1	18
298	Survivor4Ever		1	18
299	v1k		1	18
300	ELaura		1	16
301	aemiro		2	15
302	Mel_m		1	15
303	Mong0		1	14
304	Cledmir		1	13
305	NWillis		2	12
306	yrpowell89		1	12
307	radha		1	10
308	raikoti22		1	9
309	enzomanzanares		1	8
310	SitAegis		1	8
311	Capt_Parolsky		1	6
312	CyberChop		1	6
313	Kakarot		1	5
314	Loading		1	5
315	HereSwishySwishy		1	4
316	Jordangv99		1	4
317	Lorthar2488		1	4
318	moram		1	2
319	ShadowStryx		1	2
320	ksecurity		2	1
321	santodominicano		1	1
322	7cuer0s		1	0
323	aegiya		1	0
324	aless		1	0
325	alfred		1	0
326	Alvez		1	0
327	bao2		1	0
328	billy		1	0
329	BLUEDROID2027		1	0
330	brd55		1	0
331	Cocorocho		1	0
332	Cody_ronk		1	0
333	cyberdolo		1	0
334	daemon_hunter		1	0
335	DDON		1	0
336	ih1920		1	0
337	ips0		1	0
338	ips1		1	0
339	ivanht		1	0
340	khyati		2	0
341	kiko		1	0
342	KSS		1	0
343	Lionel		1	0
344	Lior		1	0
345	Lued1102		1	0
346	MacPolloZ		1	0
347	MartiNEZ		1	0
348	MojoRojo		1	0
349	paguilarLNX		1	0
350	philipe		1	0
351	potatobot		1	0
352	raul		1	0
353	Rober23		1	0
354	robin		1	0
355	RodHA		1	0
356	RWill		1	0
357	SBS		1	0
358	stinger		2	0
359	TheGoodOne		1	0
360	TheRealThreat		1	0
361	Yaku		1	0
362	parisa2301		1	-1
363	datagrammar		1	-2
364	forzie		1	-2
365	rodrigonsoares		1	-2
366	Triminator		1	-2
367	JadeX		1	-4
368	npegler		1	-4
369	RedRobin		1	-4
370	Cole		2	-5
371	Chewie		2	-6
372	Berry		4	-7
373	Jimy_Xerxes		1	-8
374	cl0wnbaby		2	-10
375	Juann		1	-10
376	SpartanCat		1	-10
377	vlAI		1	-10
378	wagrodrigo		1	-10
379	weekndr_sec		1	-13
380	Tony_Willey27		1	-14
381	mccull415		1	-18
382	detectiveBugX		1	-20
383	FJhh		2	-20
384	Xxv		2	-20
385	PJE		4	-28
386	bokal		1	-30
387	Vir1616		1	-37
388	Alex		2	-76
389	Pixie_12		2	-119

Asia League

Rank	Alias	Country	Played	Points
1	reeshee		4	1475
2	Hariom		4	1252
3	MoldyCups		4	1173
4	Rishabh		4	1156
5	Ikshvaku		4	1140
6	numerouno		4	1129
7	Zero2One		4	1075
8	JoeS		4	1058
9	Johncena		4	1045
10	caleb		3	1020
11	pkt1112		4	1020
12	Alps		4	1008
13	potat		4	1000
14	wooper_enjoyer10		4	973
15	Hopyoprop		4	962
16	SP100		4	940
17	nonder		4	895
18	shax		4	893
19	bloke-hack		4	856
20	0xDariusNG		4	814
21	k0i3n		3	757
22	hemalsoni22		4	756
23	HoneyTehO		4	755
24	ShadowHunter		4	741
25	vihan11		4	721
26	NotFound		4	716
27	VP_03		4	711
28	marshe		3	706
29	manthan1501		4	703
30	Reset		3	690
31	Rockster		3	680
32	Rockster31		3	680
33	Pichayut		4	674
34	Absol		4	645
35	PowerPuffGirl		4	645
36	Hackerbox		4	611
37	krisshh		4	603
38	Katarina		4	597
39	DingDong		4	593
40	Ash11		4	587
41	bobsburger		3	585
42	Incognito		4	583
43	Julrob		3	578
44	pessy		4	570
45	LVarma		3	559
46	Rusher		4	556
47	Zombie		4	556
48	injun		4	546
49	Rupam		2	545
50	Utkarsh2726		4	530
51	Shreya		4	523
52	Sujin		4	523
53	gwthm01		4	516
54	White_W01f		2	516
55	Sp4c3K		3	513
56	DFIRanalyst22		4	511
57	D1vy		4	510
58	M_N18		4	505
59	TheCyberHokage		3	502
60	cyslay		2	496
61	grumpycat		4	489
62	Anshul		4	486
63	Hyena		4	479
64	b4ngm4n		4	468
65	Siwoo		4	465
66	Zombieee		4	446
67	sandy		3	443
68	ansal11		3	440
69	l3Iadk		4	440
70	Mingi		4	433
71	sam		4	431
72	nothingonherebro		4	420
73	Tai		4	419
74	Mr_Flexible		3	412
75	who1sm3		2	410
76	sheefa		4	408
77	AnujKumar		3	401
78	peachydonuts		4	396
79	VIPER		4	390
80	GrantH		4	375
81	Tarak		3	369
82	CyberThreats		1	368
83	ArcNova		3	366
84	ansar13		3	364
85	Jay		3	364
86	MrHokage		4	363
87	The_BeeKeeper		4	361
88	Breezeway_MDRONE		4	354
89	HNVN		4	350
90	kammo_don		1	350
91	Krxsx		2	350
92	SamKamtekar		4	347
93	Mohammed		3	346
94	griffin-tech		4	345
95	Minyoung		3	345
96	v14		3	331
97	Anusthika		3	325
98	M_Negi		4	325
99	VIPER_JH		4	308
100	songjm		4	306
101	ThePunisheeer		4	305
102	ShinyHunter		1	304
103	BrownDefender		3	299
104	vt-ktk		1	298
105	nymos		4	293
106	ThreatYakuza		2	289
107	SmolAME		4	283
108	Hamrash		3	280
109	AK47		1	270
110	Vishal_01		1	270
111	TigerHawk		1	263
112	RCB-11		4	260
113	Parshwa		1	256
114	gnsehfvlr		2	253
115	abhesinh		4	249
116	ngonum		1	248
117	Leofire		2	245
118	giosblue		4	242
119	noctur3		1	240
120	PLZ_ENTER_TEXT		4	238
121	rajkul		3	231
122	Saba07		1	230
123	Saurav		1	230
124	vkt11		2	230
125	HarryPotter		1	226
126	ChampRR		2	225
127	uzi		2	225
128	mintbomb27		4	222
129	mop4ck		3	221
130	ditto		1	220
131	haxormad		1	220
132	HYEOK		4	219
133	nanthuNS		2	218
134	Alakamana		1	215
135	ss0001		1	215
136	teo		3	215
137	MysticSparta		2	214
138	H983r		2	208
139	Revil		3	205
140	ezhunt		4	204
141	sec_r		4	201
142	parameter		1	200
143	shubham_cas		1	200
144	Tk123		2	200
145	Shawn_Kwak		4	192
146	Chirag24		1	180
147	Faith		3	180
148	Pumpkin_18		1	180
149	Reddy_312		2	178
150	Om_Chendvankar		3	173
151	booteamer		1	170
152	King7		2	170
153	MSI		3	168
154	prithviraj		3	168
155	Kaarthik		2	166
156	Pather27		3	164
157	Vecna03		2	164
158	AvinD		3	162
159	Dipal		1	161
160	amitkp		1	160
161	shumaz_khan		3	160
162	PranavT		1	158
163	Aradhna		3	153
164	CCCC		3	153
165	kumar		1	150
166	SOC		3	150
167	tamhan		4	150
168	Pixie_08		4	145
169	Hey_nitish		2	144
170	T-S		3	144
171	DrSquarepants		3	136
172	aVc_Sentinel		3	135
173	TI-MG		2	134
174	Attacker291		4	131
175	gookbap		1	130
176	MSB1309		1	128
177	Blueteam09		2	126
178	Shruzzz		1	126
179	Shan		3	121
180	host		1	120
181	luvptg		1	120
182	ouoaaa		1	120
183	LL-Auriga		2	119
184	babuk07		1	116
185	XHUNT		3	116
186	Rajiv		1	115
187	Ravi555		4	113
188	ShadowHex		3	113
189	root		4	112
190	AshDope7		3	111
191	Napster007		2	111
192	Andro6		1	110
193	DXN		1	110
194	pdabhade		1	110
195	fchw		1	109
196	JeebyaHTB		4	109
197	musti_28		1	108
198	RedBaron		4	106
199	Sire		3	105
200	oxy		2	104
201	StranJer		2	104
202	prajeetg		1	102
203	andrew_cI		3	101
204	bibbidi		2	100
205	Vato		1	100
206	Suren		1	98
207	ansar		3	96
208	Jinesch13		2	96
209	Ninad_Gurav		1	96
210	Shawn		2	96
211	CybDefender		3	95
212	nymos		3	95
213	kzslacker		3	94
214	tIxEd		2	93
215	matrix		4	91
216	S_Jadhav		1	90
217	J3anW		2	88
218	SSJ		2	87
219	glitchMonkey		2	85
220	mrrobot		1	85
221	unknownman		1	85
222	ShivamThakur01		2	84
223	Babyshark		1	83
224	EclipseManic		1	83
225	Obfuscated_LOL		1	83
226	Adity		3	80
227	Parzival_13		1	80
228	omshrisawant		1	78
229	heogi		2	75
230	altair0-0-0-0		2	73
231	Chary_RKC		3	71
232	Chilai		1	70
233	salad		1	70
234	spicy_panner		1	70
235	MSJ		1	68
236	RootingMachine		1	68
237	soloforce		1	68
238	FoxH		1	65
239	sgkk		1	65
240	totoro		1	65
241	PerryKO		2	64
242	gr00t		2	63
243	sameer		4	62
244	bin10		1	61
245	Mr_Error_From_TN		1	60
246	prateek5		1	60
247	sunil		3	60
248	RaaV		1	58
249	Eesha		4	56
250	Optimus		1	56
251	blueteamnoob		1	55
252	alem		2	50
253	azhar		2	50
254	S41NT		1	50
255	Ad0005		1	48
256	13001e		1	45
257	akshay_hacker		1	45
258	cwasright		2	45
259	Hacker__Case		1	45
260	Moon		1	45
261	Sinchana		1	45
262	Jef		1	43
263	mtu0333		1	43
264	Zammm29		1	43
265	AVu		4	41
266	drake		3	40
267	me0w2en		1	40
268	Yuki		4	40
269	Dinesh		1	39
270	PHEAKRO		2	39
271	harshad101		1	38
272	SecOps		2	38
273	Zac		1	38
274	BADAnu		1	36
275	Darkfairy		1	36
276	Jyoti		1	36
277	Zoomlnwza007		1	36
278	Agk6		1	35
279	Expillamous		1	35
280	KHAN		1	35
281	Spider		1	35
282	Dia		3	34
283	LargeGoose		1	33
284	Sire		1	33
285	Triveni		1	33
286	ashley		1	32
287	Kali		2	32
288	Kanpur		1	32
289	ken_CTF		1	30
290	VeeK		1	30
291	Abhiramhere		1	29
292	krish		3	29
293	Default_User		1	28
294	San		1	28
295	Sanjxy		1	28
296	Will		1	28
297	NirmalDillan		1	26
298	Sagar		1	24
299	Gowda		2	23
300	Saiteja1314		2	23
301	sameer_2410		3	23
302	sreelakshmi		1	23
303	ojasav		2	22
304	hellohex		1	21
305	tigerkali		1	21
306	vinesaj		1	21
307	aichi_aito		2	20
308	Ash		1	20
309	JokerConnected		1	20
310	madhih		1	20
311	mgoyal		1	20
312	mukes		1	20
313	Somu		1	20
314	teaspark		1	20
315	ahmad		2	18
316	Arifa		1	18
317	Riddhita		1	18
318	Santosh		1	17
319	Shiva		1	15
320	sole_07		3	15
321	adika		1	14
322	Alvo		3	14
323	hieudn		1	14
324	3m_1_R3aL		1	13
325	astral		1	13
326	Hunter_54		1	13
327	NegativePointer		2	11
328	OSINT_DFIR		3	11
329	Cyduck		1	10
330	Dhruv		1	10
331	meong		3	10
332	Schutheysan		1	10
333	tsubasa		1	10
334	Vishnusoc		2	10
335	JObi		1	9
336	dani-mas		1	8
337	Fayas		1	8
338	pallavi		2	8
339	thinksysarmy		1	8
340	Vaishnavi		1	8
341	Nirali		2	7
342	Brute_Forcer		1	6
343	Roker		1	3
344	ashipaul		1	2
345	ghost1nwires		1	1
346	1uCif3R		1	0
347	abdul		1	0
348	Albiii		1	0
349	ArghyaC		1	0
350	ayaal		1	0
351	Bharat		1	0
352	buttercup		1	0
353	chow		1	0
354	CyberHokage-BY		1	0
355	D_Div		2	0
356	DouglasHaig		1	0
357	fudu1102		1	0
358	GOBLIN		1	0
359	Guneetsehgal		1	0
360	Jitendra_Gupta		1	0
361	JoJo		2	0
362	jst		1	0
363	lilyleang		1	0
364	me0w2en		1	0
365	modiji		1	0
366	Mukeshdanuskodi		1	0
367	Nani_50014312		1	0
368	nidhi		1	0
369	NOMAD		1	0
370	OSWin		1	0
371	Paw009		1	0
372	RajatS		1	0
373	RWei		1	0
374	Santhiya		1	0
375	shalender		1	0
376	SHIVAM		1	0
377	Sin		1	0
378	skkcyb3r		1	0
379	syunari		1	0
380	Theorist		1	0
381	UDubey		1	0
382	ved		1	0
383	vinay-collen11		1	0
384	ye11oc4t		1	0
385	zala		1	0
386	zkhaan		1	0
387	great_kv		1	-2
388	IND-Fury		1	-2
389	kshitijsinha		1	-2
390	nidhi		1	-2
391	qragrau		1	-2
392	Rahul		1	-2
393	rsm11		1	-2
394	Deepak		1	-4
395	Shadow		1	-4
396	Radahn		2	-5
397	ShadowWarrior		1	-5
398	Ghost_Operator		1	-7
399	Jkk		2	-8
400	SAM1		2	-9
401	SOC_Admin		1	-9
402	hackpure		1	-10
403	the3hats		1	-10
404	Vk_02		2	-12
405	matcha		1	-16
406	AnandBabu		1	-19
407	pincode		2	-19
408	FelonyBoy		1	-20
409	vineetmoses		1	-20
410	A_R		1	-22
411	danielSALTT		3	-22
412	vo1d		1	-24
413	ZAMHunter		1	-27
414	Chan1999		1	-28
415	ManikandanV		2	-28
416	Sheshell		2	-30
417	prakhar3125		1	-35
418	Red		1	-48
419	Mubasheerpmr		1	-59
420	Jasprit		1	-62
421	Prapti		1	-66
422	Hakai		1	-75
423	Nandan		1	-80
424	Marv		1	-87
425	Suryaprakash		1	-158
426	Rocko_Smith		2	-209
427	St3ll4		3	-283
428	War_Panda		1	-300

Europe League

Rank	Alias	Country	Played	Points
1	SK_HSR		4	1471
2	french_taco		4	1368
3	Arnau		4	1359
4	Deepa1196		4	1320
5	Drachh_		4	1314
6	awp		4	1225
7	elco		4	1111
8	mka		4	1098
9	Jodie		4	1085
10	Lennard		4	895
11	brudenko		4	883
12	vonny		4	871
13	Jboni		4	853
14	Matt		4	830
15	EncryptedFax		4	828
16	pgruntkowski		4	812
17	rzv		4	810
18	kochl0		4	780
19	SilentLayer		4	685
20	Vico		4	625
21	karagoz		3	586
22	Fenio		4	560
23	GilD		4	545
24	eniz127		4	537
25	megan		4	535
26	blackhat		3	516
27	sshadyan		3	513
28	mkar		4	511
29	DreddRob		4	489
30	DeGoosePlural		4	480
31	Pinax		3	480
32	swat		4	448
33	Villodre		3	435
34	primex92		2	430
35	Lee-sin		4	410
36	valencia		4	404
37	PapaStedz		4	396
38	Fok		4	386
39	Anubis85		4	351
40	6ven		4	350
41	gonda		2	338
42	desidosa		2	320
43	Pst		3	318
44	tomkerswill		4	315
45	MTSKH		3	292
46	Charlotte		4	265
47	ABogdan		2	263
48	Carlo		2	253
49	Carles		1	250
50	DzX		1	250
51	B4nd1t0		1	244
52	MaMi		4	240
53	Roffe		3	231
54	SemBios		2	223
55	orchidlillian		3	217
56	Antoine		4	210
57	panpan		1	210
58	CBVirus		2	199
59	ALDX		1	198
60	ah01		4	191
61	Danielito		3	190
62	coollee		1	188
63	waayy		2	188
64	icheptrosu		2	175
65	mrnne		4	171
66	bastian		2	170
67	neutronic		3	168
68	tdlwv		1	165
69	hannov		1	160
70	0xR4z1xx		2	156
71	Gizmo		3	155
72	CyberGeorge		1	150
73	dMarti		3	141
74	c1c1_pt		2	134
75	Stella		2	123
76	n4ffchwan		3	121
77	stephane		2	117
78	jekr		2	113
79	ChrisDJYA		1	110
80	KamX		1	108
81	Magnatron		1	108
82	SpeedyRogue		1	108
83	FoxInTheBox		1	106
84	CryptoCooCoo01		1	100
85	maximilian		1	100
86	PickleRick		1	100
87	Xavier		1	99
88	dapdomma		2	93
89	hipparcos		1	91
90	bbiskupiak		1	90
91	Costica		2	81
92	melo		2	78
93	demisto		4	76
94	SW2		2	76
95	WildCurly		2	72
96	adam		2	70
97	Terry263		1	70
98	mbarlo		1	68
99	bhav		1	66
100	Naicisum		1	66
101	dawid_pl		2	65
102	ThreatWhisperer		1	65
103	Fumetsu		3	62
104	Elyon		2	58
105	zettasecure		1	58
106	nikolakosanovic		2	57
107	Yigido		1	56
108	dcpl		1	55
109	hunterXddd		1	55
110	gambith		1	50
111	knh_threat		2	50
112	MrBunny		1	50
113	spideraxal		1	50
114	Blessinga380		1	46
115	Yen3		4	45
116	nimilsoman		2	44
117	Gospearl		1	38
118	Grimmj0w		2	38
119	BriceDeNice		3	34
120	Dante		2	33
121	Jeremy		1	33
122	milosvujovic		1	31
123	EAli		1	30
124	Maurine		1	30
125	paladin		2	25
126	churyl		2	24
127	CyberAnomaly		1	20
128	f3rx00		1	20
129	LeGOR		1	20
130	FUSH1A		1	18
131	Jihed		1	15
132	opalonycham		1	11
133	Ali1234		1	10
134	gr33n		1	8
135	HermessNRJ		1	5
136	Sajjad_nam		1	5
137	atlaSS		2	4
138	mam		1	3
139	ActionDude		1	0
140	amit		1	0
141	Ben		2	0
142	Ben		1	0
143	charly		1	0
144	cpreach		3	0
145	elia		1	0
146	Ivan		1	0
147	Jacobleo		1	0
148	Kanishk		1	0
149	kelly		1	0
150	liam		1	0
151	Lintus		1	0
152	Ptikek		1	0
153	silva		1	0
154	Stepan		1	0
155	Tsitsi		1	0
156	zack		1	0
157	skanjiru		2	-2
158	dinnu137		1	-6
159	FMS		1	-6
160	mithun		1	-6
161	sarykayyali		1	-6
162	TheMammadli		1	-6
163	odurupunar		2	-8
164	AlexRahn		1	-37
165	jacobm123		1	-52
166	nijilalseer		1	-87

Beyond the Competition

Sentinels League was built for one reason: To test real defenders in real-world scenarios and reward the best.

The skills you sharpen in a 30-minute qualifier are the same skills that matter when a real attack lands. Every flag hunted and every second against the clock all translate to what cyber defenders do every day. That’s what makes this championship different from anything else in the industry.

The community that showed up last year was extraordinary — thousands of hunters from dozens of countries joined a high-stakes competition with both skill and integrity. This year, the field is set to be bigger, the format harder, the rewards greater.

While only one player will leave Las Vegas as World Champion, every player who enters leaves sharper.

Participation is open worldwide, but prize eligibility and participation requirements are subject to the Contest Terms & Conditions — some jurisdictions are not eligible to receive monetary rewards or any other prizes. See the full rules at sentinelone.com/lp/threat-hunting-championship/ for details.

To Our Partners and Customers

The following intelligence brief was sent to all SentinelOne partners and customers today:

Executive Summary

Recent U.S. and Israeli strikes against Iranian targets, followed by Iranian attacks on multiple regional locations, present a highly dynamic geopolitical situation with credible cyber threat implications. Iran has historically incorporated cyber operations into periods of regional escalation.

Given the rapid escalation of geopolitical tensions, we assess that Iranian state-aligned cyber activity is likely to intensify in the near-term based on a long track record of leveraging cyber operations for asymmetric retaliation, coercive signaling, and strategic messaging. Prior campaigns, including destructive wiper malware, infrastructure disruption, and influence operations masquerading as ‘hacktivism’, demonstrate both capability and intent to operate in the cyber domain alongside kinetic action.

This report outlines Iran’s historical cyber posture, relevant tactics and tradecraft, and our forward-looking assessment of potential cyber responses in the days and weeks following the airstrikes.

We assess with high confidence that organizations in Israel, the United States, and allied nations are likely to face direct or indirect targeting – particularly within government, critical infrastructure, defense, financial services, academic, and media sectors.

We recommend that all clients, especially those operating in, or supporting, U.S. and Israeli infrastructure, review their security posture and preparedness accordingly.

This assessment is current as of February 28, 2026 and reflects a rapidly evolving threat environment.

Iran’s Cyber Operations to Date

Iran presents a mature, well-resourced cyberthreat based on more than fifteen years of experience across a wide range of malicious cyber events.

Iran uses a diverse set of cyber tools to further state objectives, particularly preservation of the Iranian regime, including:

• Espionage and credential theft via APT34, APT39, APT42, and MuddyWater, targeting a wide range of military, civilian, telecommunications, and academic institutions, particularly against regional targets (Israel, Middle East) and the United States
• Disruptive and destructive campaigns, including the use of wiper malware
• Targeted spearphishing and social engineering campaigns, supporting strategic intelligence collection across multiple industries
• Fake hacktivist personas for plausible deniability and psychological impact (e.g., DarkBit, Cyber Av3ngers)
• Coordinated disinformation and influence ops across Telegram, X, and compromised news outlets
• Internet blackouts within Iran to control public opinion and narrative, while similarly countering the effect of foreign influence operations
• Proxy ransomware and criminal fronts blurring lines between state and financially motivated actors

Iranian cyber actors previously aligned their operations with kinetic campaigns, often acting as a force multiplier for regional allies like Hamas or as a standalone tool of retaliation. The TTPs employed by Iranian hacktivists increasingly mirror those used by state-sponsored APTs, raising critical questions about capability sharing and formal command-and-control relationships within this environment.

Expected Iranian Cyber Response to Current Events

1 – Precision Espionage Operations

Expect escalated targeting of Israeli defense, government, and intelligence networks using spearphishing, credential harvesting, and deployment of custom malware. Historically, groups such as APT34 (OilRig) and APT42 (TA453) leveraged legitimate access to move laterally and exfiltrate strategic intelligence. Additionally, U.S. military and government organizations will likely be targeted in similar campaigns.

Anticipated Targets:

• U.S. military and government organizations
• Israeli defense entities and affiliated research organizations
• U.S. and Israeli diplomatic infrastructure
• Defense contractors and supply chain partners
• Strategic allies and locations in theater

2 – Disruptive & Destructive Tactics

Iran has a well-documented history of using destructive malware and DDoS attacks to disrupt the critical infrastructure of its adversaries. We assess a high likelihood of similar tactics being deployed against U.S. and Israeli sectors, particularly utilities and public-facing systems.

Key techniques include:

• Deployment of wipers via fake hacktivist personas or directly-attributed APT clusters
• Exploitation of unpatched or poorly secured public-facing web services for defacement and initial access
• Use of scheduled tasks and LOLBins to execute custom wiper malware with stealth and persistence

Anticipated Targets:

• Transportation, Communication, Energy and Water utilities in U.S. and Israel
• Telecom, alerting systems, and national broadcast infrastructure
• Financial platforms and digital banking services

3 – Coordinated Influence & Disinformation Campaigns

Iranian-aligned actors are likely to amplify disinformation campaigns to shape public perception, particularly around civilian impact, military failure, and geopolitical instability. These efforts often run concurrently with real-world escalations and aim to degrade public trust in institutions.

Anticipated Themes:

• Allegations of Israeli war crimes
• U.S. and Israeli military losses
• Fabricated claims of successful Iranian cyber retaliation
• Disinformation on U.S.–Israel political division
• Leaks of manipulated or stolen documents misattributed to Israeli insiders
• Lack of support from the U.S. populace for ongoing strikes against Iran

4 – Probing Attacks on U.S. & Israeli Infrastructure

Iran has demonstrated readiness to expand attacks to Western infrastructure during periods of high tension. Recent examples include the exploitation of Unitronics PLCs at U.S. water treatment plants (late 2023), highlighting a shift toward ICS/OT targets. Such actions serve retaliatory and signaling purposes and are often designed to be low-impact yet high-visibility to maximize psychological effect.

Anticipated Targets:

• U.S. defense industrial base, especially contractors supporting military action
• Israeli military and key government organizations
• Critical infrastructure (water, energy, transportation) in the U.S. and Israel
• Regional partners (e.g., Jordan, UAE, Egypt, Saudi Arabia) aligned with U.S. and Israeli interests
• Media and academic institutions reporting on the conflict

SentinelOne Detection & Monitoring Posture

SentinelOne research and detection teams have closely followed Iranian cyber actors for many years. We provide multiple layers of protection and are closely monitoring emerging threat intelligence to maximize coverage.

We extensively cover techniques known to be used by Iranian threat groups including:

• PowerShell and script abuse
• Proxy tools
• Credential theft
• Keylogger components
• Wipers
• Browser credential theft
• DLL sideloading
• Tunneling tools (ngrok/Cloudflared)
• Scheduled task persistence
• Remote access tool abuse
• Active Directory reconnaissance
• Destructive boot tampering

These protections are not Iran-specific but known to be effective in detecting their operations.

We are monitoring the situation closely and can ship new detections quickly through Platform Rules updates or Live Security Updates.

Recommendations

1. Increase Vigilance Against Phishing and Credential Abuse

• Prioritize MFA enforcement and internal phishing detection
• Monitor for abuse of VPN, email, and collaboration platforms
• Monitor for suspicious activity involving legitimate user accounts and applications

2. Harden Critical Infrastructure and OT Environments

• Patch and segment exposed ICS components, especially common HMI/PLC vendors
• Scan all Internet-facing infrastructure, and patch any vulnerable Internet-facing services
• Consider removing or restricting network access to any non-critical Internet-facing services, especially if they are not protected by MFA
• Review DDoS mitigation playbooks and response procedures

3. Monitor for Influence Operations and Fake Leaks

• Establish rapid communication response protocols for disinformation relevant to your organization
• Be prepared for threat actors using “hacktivist” branding and Telegram/Telegram-style platforms for communication
• Consider there are likely masquerade efforts and this requires a detailed assessment to determine true origin

4. Review and Test Incident Response Plans

• Ensure IR and SOC teams maintain heightened alert status
• Simulate data-wipe and ransomware scenarios
• Simulate corporate social media hijacking scenarios and prepare for account pausing/access resets

5. Establish Clear Points of Contact

• Ensure internal organization has direct POCs for support for security incidents
• Communicate posture expectations and escalation paths internally

6. Monitor for activity associated with Iranian state-aligned threat actors

SentinelOne is proactively hunting for IOCs and TTPs associated with these groups. These threat hunts are being performed for all Wayfinder Threat Hunting customers. Any related hunt findings will be visible in the Wayfinder Threat Hunting dashboard.

Closing Note

This report is intended to support informed decision-making and proactive defensive measures amid a dynamic and escalating geopolitical conflict.

The cyber threat landscape associated with Iranian state-aligned actors is adaptive, and we assess that both targeting priorities and tactics may shift rapidly in response to real world developments, political statements, or perceived provocations.

We advise clients to treat this as a time-sensitive assessment and to revisit posture, incident response, and monitoring processes regularly.

For immediate questions or escalations, please contact your Client Success Lead or reach our Support teams directly at: https://www.sentinelone.com/global-services/get-support-now/

Appendix

Customers should consider activating Platform Detection Library rules to improve coverage. The following rules are known to be effective against Iranian cyber operations:

MuddyWater

• Possible MuddyWater DLL Drop Consistent with Audio Driver Sideloading

Credential Dumping

• Suspicious Task Creation for Credential Harvesting
• Python-Based Network Exploitation Tool
• Potential LSASS Dumping Tools
• Credential Dumping via Shadow Copy
• Interactive NTDS Harvesting via VSS
• Cached Domain Credential Dumping

Tunneling & Remote Access

• Ngrok Domain Contacted
• Cloudflared Persistent Tunnel Establishment Detected
• Anomalous Process Initiating Cloudflare Tunnel Traffic

Collection & Exfiltration

• Keylogging Script via PowerShell
• Chromium Browser Info Stealer via Remote Debugging
• Browser Credential and Cookie Data Access Attempt

PowerShell/Script Abuse

• PowerShell Script Execution via Time Based Integer IPv4
• Suspicious Usage of .NET Reflection via PowerShell
• Encoded Powershell Launching Command Line Download

Defense Evasion, Impact, Discovery

• Potential DLL Sideloading in PerfLogs Directory
• Disk Data Wipe Attempt via Dd Utility
• Boot Configuration Tampering via BCDEdit
• BloodHound Active Directory Reconnaissance File Creation

AI coding assistants are no longer just autocompleting lines of code, they are quietly making decisions for you. Tools like Claude Code are able to read projects, plan multi-step changes, install dependencies, and modify files with minimal human oversight. To make this possible, these assistants rely on plugin marketplaces, where third-party developers can enable ‘skills’ that teach the agent how to manage infrastructure, testing, and dependencies. Though powerful, the model requires a high degree of trust, thus bringing with it a new set of risks.

At a first glance, third-party marketplace plugins are harmless productivity boosters. Connect a marketplace and enable a plugin so your coding assistant becomes smarter about your stack. However, beneath the convenience is a security blind spot: These same skills often run with extremely high privilege and very little transparency on how they make decisions or where the code and dependencies are coming from. The code issue isn’t prompt manipulation or social engineering – it’s compromised automation.

A full technical blog post by SentinelOne’s own Prompt Security team breaks down how a single benign-looking plugin from an unofficial marketplace exposes a dependency management skill. When the developer asks the agent to install a common Python library, that skill quietly redirects the install to an attacker-controlled source, ensuring a trojanized version of the library is pulled into the project. While nothing looks wrong – the library imports cleanly, the example code runs without error – malicious code is now embedded into the environment, capable of exfiltrating secrets, monitoring traffic, or lying dormant until it is triggered at a later time.

What makes this especially concerning is persistence. Marketplace plugins are not one-off interactions. Once enabled, their skills remain available across sessions and will continue to shape how the agent behaves in the future. Rather than a ‘bad prompt’, this effect is more like compromising your package manager itself.

As AI-driven development workflows accelerate, plugin marketplaces and third-party skills are now part of the software supply chain whether teams realize it or not. If your coding assistant can fetch and execute code on your behalf, every plugin installed joins your trust boundary.

Read the full blog post here for a detailed walkthrough of the attack mechanics and learn why dependency skills are such a powerful, but under-modeled, risk.

Third-Party Trademark Disclaimer:

All third-party product names, logos, and brands mentioned in this publication are the property of their respective owners and are for identification purposes only. Use of these names, logos, and brands does not imply affiliation, endorsement, sponsorship, or association with the third-party.