KC7 Cyber: The Free Cyber Detective Game Explained (2026)

What Is KC7?

KC7 is a free online cybersecurity game in which players investigate realistic, fictional cyber attacks by searching through security logs. Each case is a mystery: you get a company, a story, and millions of rows of email, web, and endpoint data, then answer questions that lead you from a first clue to the full picture of the attack.

A few facts worth knowing before you sign up:

• It is run by a nonprofit. The game is operated by the KC7 Foundation, a registered 501(c)(3). The KC7 homepage promises "Free forever" and "No credit card."
• It was built by working threat analysts. KC7 was founded by Simeon Kakpovi, a threat intelligence analyst at Microsoft. Greg Schloemer and Emily Hacker co-authored the original training guide, and Schloemer serves as the foundation's vice president.
• It started small. According to KC7's About page, the project began in 2019 as a hand-typed dataset shared with a community college class. Microsoft's Unlocked profile traces its growth through Microsoft's 2022 Global Hackathon.
• The name is a kill chain reference. Microsoft's profile explains that "KC7" points to the final stage of the attack process. In the Lockheed Martin Cyber Kill Chain, that is stage seven, "Actions on Objectives," the moment an attacker does what they came for.

That last point tells you what the game is about. If the kill chain is new to you, our Cyber Kill Chain explainer walks through all seven stages. In KC7, you see those stages from the defender's chair: a phishing email lands, someone clicks, a file drops, a process runs, data leaves. Your job is to find each step in the logs.

How KC7 Works

Every KC7 case (the site also calls them modules or games) follows the same structure, so once you have played one, the rest feel familiar.

The case page and the scoreboard

You sign up with Google, Microsoft, or email, or click "Continue as Guest" and claim the account later. Each case opens with a short story and a list of questions. Answers are exact facts: an email address, a domain, a file name, a timestamp, a count. Type one into the scoreboard and you know instantly whether you are right. Correct answers earn points and badges, and your rank appears on a global leaderboard.

The data lives in Azure Data Explorer

The logs for most cases are hosted in Azure Data Explorer (ADX), Microsoft's log analytics service. The case gives you the dataset link, and many cases can show the ADX query pane right inside the KC7 page. Opening ADX on its own asks you to sign in with a Microsoft account, and a free personal one works. You never install anything.

Inside ADX you write queries in KQL, the Kusto Query Language. This is the part that makes KC7 more than a game. Microsoft documents KQL as the language of Microsoft Sentinel and Azure Monitor, so the queries you type to catch a fictional hacker are the same kind real SOC analysts type every day.

Difficulty levels, learning paths, and the daily question

• Difficulty ranges from Beginner to Expert. Case pages list an estimated time, from about 50 minutes for "A Rap Beef" to dozens of hours for long intermediate investigations like "AzureCrest."
• Learning paths group cases in order. The modules page shows four "Security Analyst" paths (I to IV), with Incident Responder and CTI Analyst paths marked as coming soon.
• DAILY7 adds one question a day. Enter the codeword DAILY7 on the scoreboard and a new question appears daily, covering topics like OSINT and decoding. It is built for streaks.

KC7 vs a Classic CTF

KC7 often gets called a CTF, and it does share the scoreboard and the "find the answer" loop. But the skills it trains are different, and knowing that helps you decide where to spend your evenings.

Our take: do both. Offensive CTFs teach you how attacks work, and KC7 teaches you what those attacks leave behind. Analysts who have exploited a SQL injection spot one in a web log much faster, and attackers who have read logs make fewer noisy mistakes. If you have never played an offensive CTF, our CTF for beginners guide covers how to start that side.

KC7 is also the friendlier entry point for one type of beginner: people who like puzzles and spreadsheets but feel lost in a Linux terminal. There is no shell, no compiling, and no exploit that refuses to work for reasons nobody explains. You read data and ask it questions.

How to Play Your First KC7 Case

Start with "A Rap Beef: An Intro to Security Investigations." Its case page marks it as Beginner, about 50 minutes, worth 950 points, and says "Anyone can do this! No prior experience necessary." You play a security analyst at a record label whose two artists are feuding, and the objectives are to identify a phishing campaign, read security logs, and investigate a basic intrusion.

Here is the routine we recommend for this case and every case after it:

1. Read the whole story and every question first. The questions are a map of the attack. If question 9 asks about a downloaded file, you know a download happened and you can watch for it from the start.
2. Sample every table. Run take 10 on each table before anything else. You learn which columns exist and how values are written (lowercase emails, full URLs, UTC timestamps).
3. Start from the clue the story gives you. Usually a suspicious domain, sender, or IP. Search for it in the most obvious table, often Email.
4. Pivot. Take one value from your result, such as a recipient, and look it up in the next table. Recipient leads to IP address, IP leads to web traffic, web traffic leads to a download.
5. Keep a notes file. One line per finding: time, who, what, where. Half the later questions are answered straight from your notes.
6. Copy answers exactly. The scoreboard compares strings. A missing subdomain or an extra space is a wrong answer even when your reasoning is perfect.

The KQL You Need for KC7

You do not need to "know KQL" before your first case. KC7's original training guide teaches the essentials in a few pages, and six operators carry you through most beginner and intermediate questions. That guide lists eight tables (Employees, Email, OutboundBrowsing, AuthenticationEvents, FileCreationEvents, ProcessEvents, PassiveDns, and InboundBrowsing). Newer cases sometimes rename or add tables, which is exactly why step 2 above is "sample everything."

The examples below use made-up data from a fictional company, not answers from any real case. Column names are illustrative too, so confirm the real ones with take 10.

1. Look before you search: take

Employees
| take 10

Every query starts with a table name. The pipe | passes the rows to the next operator. Here, take 10 shows ten rows so you can see the columns.

2. How many: count

Email
| where recipient == "[email protected]"
| count

Questions like "How many emails did Dana receive?" are a filter plus count.

3. Filter: where, with == or has

Email
| where sender has "acmeverify"
| project timestamp, sender, recipient, subject, link

== is an exact match. has looks for a whole term inside the text. project keeps only the columns you care about, which makes results readable.

The result is the kind of table that cracks a case open (trimmed for width):

timestamp             sender                         recipient          subject
2026-03-03T09:14:02Z  [email protected]  [email protected]  Password expires today
2026-03-03T09:14:05Z  [email protected]  [email protected]  Password expires today
2026-03-03T09:14:09Z  [email protected]  [email protected]  Password expires today

Three employees, one look-alike domain, one urgent subject line. That is a phishing campaign, and each recipient is now a lead to pivot on.

4. Unique values: distinct

Email
| where link has "acmeverify"
| distinct recipient

Use distinct when a question asks "which users" or "how many different domains."

5. Many values at once: in

PassiveDns
| where ip in ("203.0.113.40", "203.0.113.41")
| distinct domain

This finds every domain hosted on the attacker's IPs. Attackers reuse infrastructure, so one bad domain often leads to five more.

6. Chain queries: let

let victims = Employees
| where name in ("Dana Ruiz", "Omar Haddad", "Lena Novak")
| distinct ip_addr;
OutboundBrowsing
| where src_ip in (victims)
| where url has "acmeverify"

let stores the result of one query so the next can use it. This is pivoting written as code: employees to IPs, IPs to web traffic, all in one go.

The has vs contains trap

Sooner or later a query that "should" return results comes back empty. The usual cause is has. Microsoft's string operator documentation explains that has matches whole terms, so "KustoExplorerQueryRun" has "Explorer" is false, while contains matches any substring and returns true. Use has by default because it is faster, and switch to contains when you are hunting for a fragment inside a longer word.

One more naming trap: "KQL" also stands for Kibana Query Language in the Elastic stack, a different language with the same initials. If you want to see the same filter-then-aggregate thinking in Splunk SPL and Elastic, the log analysis with queries chapter of HackerDNA's SOC Analyst course walks through a brute-force investigation in both.

KC7 as a Competition Alternative

Many people search for KC7 because a teacher, club, or company ran it as an event. That is one of its best uses, and it costs nothing.

• GameOn lets anyone host. KC7 describes GameOn as a "free teaching platform with classrooms, progress tracking, and a cyber competition." Educators, corporate trainers, and community organizers fill in a short request, and the GameOn page says first-time requests are "usually ready within minutes," with an organizer page, a player link, and a dashboard.
• It works for mixed skill levels. Because every question is a filter or a pivot, a complete beginner can score on easy questions while experienced players race through the later ones. That is hard to achieve with a classic CTF, where a beginner can spend a whole weekend on one unsolved challenge.
• It runs year-round. Unlike seasonal events such as the National Cyber League or Advent of Cyber, KC7 cases are always open, so a club can use it any week of the school year.

If you organize a club, our suggestion is simple: run "A Rap Beef" as a one-hour kickoff session, with pairs sharing a screen. Pairs talk through their pivots out loud, which is how analysts actually learn from each other.

Is KC7 Good? Our Honest Verdict

Yes, KC7 is one of the best free resources for learning defensive security. Here is why, and where it falls short.

What it does well

• Real skills, zero setup. KQL in ADX is a job skill, not a game mechanic, and you start in a browser tab.
• Stories make it stick. You remember "the phishing domain that also hosted the malware" far longer than a slide about indicators of compromise.
• Gentle difficulty curve. The beginner cases genuinely assume nothing.

Where it falls short

• One tool. You will not touch Wireshark, memory forensics, or Splunk. KC7 teaches log querying, not the full SOC toolbox.
• Long cases are long. Some intermediate cases are listed at 45 to 96 hours. Plan them as projects, not evenings.
• No offensive side. You see attacks only from their traces, so you never learn why an exploit worked.

The best path we know: KC7 for log thinking, then a platform with packet captures and disk images. Our CyberDefenders beginner's guide covers that next step, where you trade KQL for Wireshark, memory dumps, and SIEMs.

Legal and Ethical Considerations

• Do not visit indicators from a case. KC7's training guide calls this good OPSEC: as an analyst, you research suspicious domains through data like passive DNS instead of browsing to them.
• Respect privacy in real jobs. The guide also points out that companies log email metadata, not full content, to protect employees. Real log access comes with real confidentiality duties.
• Keep answers off the internet. Sharing answer lists spoils the game for other players and for the classes that use KC7 as a free curriculum. Share your method, not your answers.

Frequently Asked Questions