Post cover image
Photo by Luis La from Pexels

October 31, 2026

The Call Is Coming From Inside the House

Eight horror movie rules every SOC already knows, and keeps breaking anyway.

By Serhan Eraslan

8 min read

Every horror movie runs on the same engine: smart people making terrible decisions at the worst possible moment. Someone hears a noise in the basement and goes to check. Alone. In the dark. With a flashlight that has never once in cinema history had fresh batteries.

We laugh at them from the couch. Then we go to work, see a login from an account that should not be active at 03:00, and think: probably nothing.

It is Halloween, so let's be honest about it. Incident response has its own horror tropes, and most of us have played a supporting role in at least one of them. Here are eight rules the genre taught us, translated into SOC language, with a few MITRE ATT&CK techniques along the way so this still counts as professional development.

Rule 1: The call is coming from inside the house

The babysitter keeps getting creepy phone calls. The police trace them. The calls are coming from inside the house. Cue screaming.

In security, this is T1078: Valid Accounts, and it is less a plot twist than a weekly occurrence. The attacker does not break a window. They walk in through the front door with a key someone left under the mat, and every alarm in the house politely stays quiet, because a valid login is, technically, a valid login.

The numbers are not comforting. IBM X-Force's 2026 Threat Intelligence Index says valid account misuse showed up in nearly a third of its cases, even after losing the top spot to vulnerability exploitation. Cisco Talos put valid accounts as the second most common initial access vector in Q1 2026, at 24% of engagements.

The scary part is not the intruder. It is that the intruder looks exactly like Ahmet from Finance. Same username, same VPN, same "forgot my password again" energy.

The SOC lesson: stop asking only "is this login valid?" and start asking "does this login make sense?" Impossible travel, a service account suddenly logging in interactively, a dormant account waking up at 03:00. The phone is ringing. Check which room it is coming from.

Rule 2: Never split up

"Let's split up, we'll cover more ground." Famous last words, usually said by the character with the best hair, about eleven minutes before they stop being in the movie.

None

Incident response has its own version. The SOC sees the alert. The network team sees the weird traffic. The sysadmins see the server rebooting at odd hours. Each group investigates its own corner of the haunted house, nobody compares notes, and the attacker strolls calmly down the hallway between them.

Splitting up is not the problem. Splitting up without talking is. Every team holding one piece of the map is how a three-hour incident turns into a three-week one.

The SOC lesson: one incident, one channel, one owner. Agree on who is calling the shots before the lights go out, not after. If your incident response plan still lists a person who left the company two years ago as the escalation contact, that is not a plan. That is a ghost story.

Rule 3: The killer always gets back up

The hero finally lands the big hit. The killer goes down. The hero drops the weapon, turns around, and walks away slowly, breathing heavily. Everyone in the audience is screaming the same thing: he's not dead.

In ATT&CK terms, the killer has Persistence. A scheduled task nobody checked. A registry run key quietly waiting for the next reboot. A second web shell in a folder named something boring like backup_old. You reimaged the laptop, closed the ticket, and wrote "remediated" with the confidence of a horror movie protagonist.

It also happens at nation-state scale. After the FBI-led takedown of Volt Typhoon's KV botnet in December 2023, the group did not retire. According to Black Lotus Labs, it had already started building a new relay network called Silent Train before the takedown, and simply leaned on it harder afterwards. Sequel confirmed.

The SOC lesson: "we removed the malware" and "we removed the attacker" are two very different sentences. Before you walk away, check for the boring stuff: new accounts, new tasks, new services, new keys. Then check again in a week. Killers love a sequel.

Rule 4: Don't go into the basement alone

There is a noise downstairs. It is the middle of the night. Everyone else is asleep. Naturally, our hero picks up a candle and goes to investigate. Alone.

None

Attackers watch horror movies too, and they know when the house is emptiest. Sophos's 2026 Active Adversary Report, built on 661 incident cases, found that 88% of ransomware payloads were deployed outside business hours, and 79% of data exfiltration happened off-hours as well. Friday night, holiday weekend, the evening of the company party. Halloween night, probably.

Meanwhile, in the SOC, the night shift is often one analyst, a lot of coffee, and an unspoken rule that waking up the senior engineer at 02:00 is a career-limiting move. So they go into the basement alone. They try to handle the suspicious encryption activity themselves, because escalating feels like admitting there is a monster.

The SOC lesson: make escalation cheap. Write down, in advance, exactly what is worth a 02:00 phone call, and promise the night shift nobody will be angry about a false alarm. A woken-up manager is grumpy for a morning. An unescalated ransomware deployment is grumpy for a quarter.

Rule 5: "It's probably just the wind"

A shutter bangs. A floorboard creaks. Something moves in the corner of the frame. "It's probably just the wind," says the character, and goes back to bed. The audience knows better. The audience always knows better.

In the SOC, "the wind" has a name: false positive. And to be fair, the wind blows a lot. A Cloud Security Alliance research note from September 2026 cites a Microsoft and Omdia study where 46% of alerts turned out to be false positives and 42% were never investigated at all. The same note points to the SANS 2025 Detection and Response Survey, where 73% of organizations named false positives as their top detection challenge.

So nobody is lazy here. When the same rule has fired 300 times this month for the same backup job, the 301st time really does sound like the wind. Until it is not.

As someone who spends most of his days building SOAR playbooks, I have a confession: automation is how we survive the wind, and also how we accidentally teach ourselves to ignore it. A playbook that auto-closes "known benign" alerts is wonderful, right up until the attacker learns what "known benign" looks like.

The SOC lesson: tune the noisy rules instead of tuning out the analysts. Every "just the wind" closure should leave a trail: why it was closed, by whom, based on what. And once in a while, actually go look at the shutter.

Rule 6: Don't read the Latin out loud

A group of friends finds an old book in a cabin. It is bound in something that is definitely not leather. There is a passage in Latin. Someone reads it out loud, mostly as a joke. The demon would like to thank them for the invitation.

None

The 2026 version of the cursed book is called ClickFix. A fake CAPTCHA or a fake "your browser needs a fix" page tells the user to open the Run dialog or a terminal, paste a command, and press Enter. That is it. That is the whole ritual. The user summons the malware themselves, by hand, with full confidence. MITRE even gave it its own entry: T1204.004, Malicious Copy and Paste.

And the demons keep updating their spellbooks. In February 2026, Microsoft saw a campaign that skipped the classic Run dialog and walked victims into Windows Terminal instead, because it looks more like real admin work. ReversingLabs describes ClickFix as a full Malware-as-a-Service economy by now. A small comfort: the same report notes that one ClickFix MaaS backend was exposed in April 2026 because of its own operators' security lapse. Even demons forget to lock the cabin.

The SOC lesson: the rule for users is simple enough to fit on a sticker: no real website will ever ask you to paste a command to prove you are human. The rule for the SOC is to watch what the Run dialog and terminals spawn. PowerShell, mshta or msiexec launched straight from explorer.exe after a paste is not a user being productive. It is someone reading Latin.

Rule 7: The phone has no signal

The moment things get serious, someone pulls out a phone to call for help. No signal. The landline is dead too. Someone cut the wires, and they did it hours ago, while everyone was busy enjoying the party.

Now picture a real incident. The attacker has domain admin. They have been reading the CISO's inbox for two weeks. And the incident response team is coordinating the response… in a Teams channel, on the same tenant, using the same accounts the attacker already owns. You are not hiding from the killer. You are planning your escape in the group chat he is a member of.

This is one of the least glamorous parts of incident response, and one of the most skipped. Nobody wants to talk about out-of-band communication until the night they need it, at which point it is too late to install anything.

The SOC lesson: decide your backup channel before the incident. A separate messaging workspace, accounts that do not depend on corporate SSO, a printed contact list with actual phone numbers. Test it once a year, the same way you would test a fire exit. If your only plan is "we'll figure it out on Slack", the killer has already cut the wires.

Rule 8: Be the final girl

Every slasher has one survivor. The final girl is not the strongest character or the luckiest one. She is the one who paid attention. She noticed the door that was open when it should have been closed. She did not go into the basement alone. She checked whether the killer was really dead. She knew where the car keys were before she needed them.

In other words, she did all the boring things from rules one through seven.

That is the uncomfortable truth about incident response: the survivors are rarely the teams with the fanciest tools. They are the ones with clean logs that go back far enough, a runbook someone has actually read, an escalation path that works at 02:00, and an analyst who looked at the "probably nothing" alert one more time.

The SOC lesson: preparation is not exciting, and nobody makes a movie about it. But the final girl walks out of the house at sunrise. Everyone who skipped the boring parts stays in the credits.

None

Epilogue: the sequel is already in production

If one rule stuck with you, I hope it is the first one. The intruder with valid credentials is the quietest monster in the house: no broken windows, no screaming, just a login that looks exactly like a colleague's.

That is why my next pieces will take a closer look at T1078 Valid Accounts, without the costumes this time. How attackers get the keys, why our tools politely let them in, and what actually helps us notice the difference.

Until then: lock the doors, check the basement in pairs, and if a website asks you to paste something into your terminal, read the Latin silently.

Happy Halloween. 🎃

Seron Out, Boo! 👻

;

Sources