CFR-410 case studies
CFR-410 · Put your knowledge to work in context.
CyberSec First Responder® – Advanced (CFR-A) is an advanced, hands-on cybersecurity credential from CertNexus. It builds on the defensive skills covered in CyberSec First Responder® (CFR) and is aimed at practitioners in red-team, blue-team, or hybrid roles who want to validate advanced knowledge of attack simulation, threat analysis, security testing, digital forensics, and cyber defense techniques. The CFR-410 case studies are 5 cases and about 3,697 words.
1Invoice Portal: Did the SQL Injection Actually Land?
Northline Retail runs a PHP/MySQL invoice portal on two Apache 2.4 nodes behind an F5 load balancer. The WAF was moved to detect-only mode during a checkout redesign three weeks ago and never returned to blocking.
743 words, about 4 min2Backup Account Lights Up the Finance VLAN
Meridian Health's SOC receives a correlation alert at 09:42: service account svc backup generated 14 successful 4624 events with Logon Type 3 to hosts FIN-WS-11 through FIN-WS-23, all sourced from FIN-WS-07, within 88 seconds. The authentication package is NTLM, not Kerberos.
742 words, about 4 min3Beaconing Engineers and a Domain Controller
Vantage Logistics has 380 Windows endpoints, 22 servers, and a flat /16 network with no internal segmentation. The proxy permits outbound TCP 443 to any destination, and engineering workstations are exempted and connect direct-to-IP.
727 words, about 4 min4FS01 Ransomware Staging Under Legal Hold
At 06:05 the EDR console flags FS01, a 4 TB Windows Server 2019 file server, for vssadmin.exe delete shadows /all /quiet launched by a process whose parent is wmiprvse.exe. At 06:07 a file named HOW TO RESTORE.txt appears in 12 shares.
752 words, about 4 min5Edge VPN Appliance: Zero-Day With an Active Foothold
On Monday a researcher publishes details of a pre-authentication path traversal in the administrative web interface of the SSL VPN appliance model used by Corevault Systems. There is no vendor patch, only a workaround that blocks the traversal URI pattern.
733 words, about 4 min