DSTC case studies
DSTC · Put your knowledge to work in context.
The DSTC is a defensive security certification aimed at practitioners who need to detect, investigate, and respond to threats rather than simply build controls. It suits SOC analysts, security engineers moving into operations, and IT administrators who have inherited monitoring duties. The DSTC case studies are 5 cases and about 3,155 words.
1Ransomware Precursor on the Finance VLAN
At 02:14 on a Tuesday, the SIEM alerts on 41 failed SMB authentications from workstation FIN-014 (user: t.okafor) against five file servers in 90 seconds, followed by one success against FS-02 and a burst of 1,200 file-rename operations with the extension .locked. EDR shows a signed-but-unusual binary launched from %TEMP% three minutes earlier, parented by an Excel macro.
587 words, about 3 min2Flat Network, One Segmentation Window
A 600-employee manufacturer runs a single /16 flat network. OT controllers on the plant floor share the same VLAN as corporate laptops because 'it was easier in 2019.' A recent pen test found that a compromised marketing laptop could reach the PLC programming workstation in three hops.
583 words, about 3 min3EDR Rollout on Legacy Endpoints
You must deploy a new EDR agent to 4,200 endpoints. Inventory shows: 2,800 Windows 11 (fully patched), 900 Windows 10 21H2 (out of support in weeks), 300 Windows 7 SP1 machines running a line-of-business app the vendor will not certify past Win7, and 200 macOS 12/13 laptops.
610 words, about 3 min4MFA Push Fatigue on the VPN
Over 48 hours, the helpdesk logs 60 'I keep getting MFA prompts' tickets from users across departments. The IdP shows a spike in push approvals from unfamiliar ASNs, mostly between 01:00 and 04:00 local.
588 words, about 3 min5Retention vs. Investigation on a Shared Log Platform
Your SIEM ingests 2.1 TB/day and retention is 30 days hot, 90 days cold. A regulator's inquiry arrives about an incident that occurred 11 weeks ago; the relevant logs are in cold storage but the vendor's cold-tier restore takes up to 5 business days and costs per-restore.
787 words, about 4 min