<p>Clarifying the behaviors that passengers exhibit when suspicious persons appear is important to detect the appearance of a suspicious person on a train at an early stage. We analyzed the behaviors (first behavior of passengers on nearby cars, running, self-centered behavior, cooperative behavior, exit choice) based on a video taken by a passenger involved in a stabbing incident. Our analysis suggested that many passengers began to evacuate even before clearly recognizing the presence of a suspicious person. Running behavior was particularly prominent among passengers escaping from the car where the fire was set, while those in the adjacent car showed a lower tendency to run. Self-centered behavior included overtaking others and urging those ahead or near the exits to move faster, including requests to train crew. Cooperative behavior was also inferred, such as supporting others, holding doors open, and calling out to calm or inform fellow passengers. Passengers tended to choose exits that were close and unoccupied, even if they were near the suspicious person. Our findings provide theoretical insights into how passengers behave in closed environments such as trains, where evacuation decisions are made with limited information during unexpected stabbing incidents. We will continue to explore ways to support more effective evacuation during emergencies (e.g., through in-car announcements) by understanding passengers’ actual behaviors.</p>