CISP-TRE case studies

CISP-TRE · Put your knowledge to work in context.

CISP-TRE (Certified Information Security Professional – Threat Response and Engineering) is a vendor-neutral credential aimed at defenders who do more than triage alerts: analysts, incident responders, detection engineers, and SOC staff who build and run the tooling that catches and contains intrusions. The exam is delivered in Chinese and tests nine domains, weighted toward threat intelligence and analysis, threat hunting and detection engineering, and incident response and handling (15% each), with smaller blocks on malware analysis and reverse engineering fundamentals, network security monitoring and traffic analysis, endpoint detection and response, SOC operations and automation, digital forensics and evidence handling, and threat response engineering and tooling. The CISP-TRE case studies are 5 cases and about 5,482 words.

A 9,400-indicator ISAC feed and a board metric that rewards volume

You are the CTI lead at a mid-sized retail bank with 2,300 staff and 900 servers. On Tuesday your sector ISAC pushes a MISP event tagged as targeting retail banking; it carries 9,400 indicators, 7,800 of them SHA-256 file hashes.

1,061 words, about 5 min 2

Ransomware across file servers and ESXi with a backup server in the blast radius

At 02:10 on a Saturday your SIEM correlates EDR file-modification telemetry across three file servers and one domain controller: 61,000 files renamed with a .crypt extension and a README note dropped in 14 minutes. Two ESXi hosts run 48 production VMs and carry no EDR agent.

1,085 words, about 5 min 3

900 hosts, long DNS labels, and a service-discovery system that looks like a tunnel

You are a detection engineer for an ISP-managed SOC covering a /16 with roughly 18,000 active hosts; Zeek writes about 160 million connection records a day. On Wednesday a hunting rule fires on 900 internal hosts resolving subdomains of one registered domain.

1,069 words, about 5 min 4

4,300 EDR alerts a day and a rule that cannot be scoped by parent process

You are the detection engineering lead for a 6,000-endpoint estate. EDR produces about 4,300 alerts a day: 3,850 are 'suspicious process access' raised by the backup agent's volume-shadow-copy component, 210 are unsigned PowerShell launched from IT's automation share, and the remaining 40 are the noisy tail.

1,090 words, about 5 min 5

Defensible evidence from a compromised EC2 instance inside an Auto Scaling group

You are the forensics lead on a cloud incident. GuardDuty raises CryptoCurrency:EC2/BitcoinTool.B for a public-facing EC2 instance running a customer web application; the developer confirms outbound connections to a mining pool.

1,177 words, about 6 min