CRIE case studies
CRIE · Put your knowledge to work in context.
The CRIE is a professional certification focused on cyber incident response and evidence handling. It is aimed at practitioners who are expected to run or support an incident end to end: SOC analysts moving beyond triage, incident responders, forensic examiners, security engineers, and consultants or team leads who own escalation and recovery decisions. The exam is multiple choice and is structured around seven domains: incident response fundamentals and frameworks, preparation and planning, detection and identification, containment/eradication/recovery, evidence handling and forensic analysis, communication and coordination, and post-incident lessons learned. Containment, eradication, and recovery carries the largest weight, so time spent there pays off disproportionately. The CRIE case studies are 5 cases and about 3,278 words.
1The Ransomware Note That Arrived Before the Alert
At 02:14 on a Saturday, the on-call analyst receives a ticket from the help desk: a finance user cannot open her shared drive. By 02:40, 340 files across three departmental shares show the extension .lckd , and a ransom note named READ ME.txt sits in each affected folder.
580 words, about 3 min2The Phishing Cluster With a Deadline
A security operations center sees 47 reports of a credential-phishing email over six hours. The messages spoof the internal payroll portal and link to a domain registered nine days ago.
547 words, about 3 min3Disk Image or Live Response?
A workstation is suspected of being the staging host for data exfiltration. The user is a senior executive who is traveling and will return in 36 hours; the laptop is currently powered on and connected to the corporate network.
753 words, about 4 min4The Contained but Not Eradicated Intruder
An intrusion is confirmed on a database server. The team has blocked the attacker's known C2 IP at the firewall and disabled the compromised service account.
683 words, about 3 min5The Lessons-Learned Meeting That Went Nowhere
Two weeks after a contained ransomware incident, the incident commander convenes a post-incident review. Attendees include IT operations, the SOC, the help desk, and a business unit lead.
715 words, about 4 min