ECIH case studies
ECIH · Put your knowledge to work in context.
The EC-Council Certified Incident Handler (E CIH), currently offered as version 3, is a specialist credential focused on organizational incident handling and response. EC-Council positions it for mid-level to senior cybersecurity professionals with a minimum of one year of experience, and for information security practitioners who want to deepen their incident response skills. The ECIH case studies are 5 cases and about 4,246 words.
1Fourteen Encrypted Endpoints, One Responder, and a 09:00 Demo
At 06:40 on a Monday, the help desk reports that 14 of 60 Windows workstations display a README.txt demanding payment and that files now end in .lckd . The organization runs two on-prem file servers, Windows Defender only (no EDR), and no central log collection.
852 words, about 4 min2Invoice Thread, Warsaw Sign-In, and a Consented App
On a Tuesday morning, a finance clerk forwards an email thread she finds odd: a supplier's invoice reminder, sent under the correct display name, but the reply-to domain is supplier-invoices.co rather than the supplier's real domain. Checking her mailbox, you find an inbox rule created nine days ago that moves any message containing 'invoice' or 'payment' into the RSS Feeds folder.
810 words, about 4 min3Three-Minute Beacons and an SMB Sweep on a NetFlow-Only Network
You support a 700-host network with NetFlow from the core switches, Windows event forwarding from servers only, and a single SPAN port on the user VLAN feeding short-retention packet capture. During a review you notice one workstation opening roughly 40 TLS sessions per day to a single external IP, spaced about three minutes apart with slight jitter and near-symmetric byte counts.
768 words, about 4 min4A World-Readable Billing Bucket and a CI/CD Key With AdministratorAccess
A researcher emails your public security@ alias: the bucket acme-prod-billing-exports is world-readable and contains about 40,000 PDF invoices from the past eight months. CloudTrail is enabled with default 90-day retention; S3 server access logging is off.
869 words, about 4 min5The Resigning Engineer, 1.1 GB of SharePoint, and a 14:00 Walk-Out
A platform engineer with twelve years' tenure resigned eight days ago; his last day is Friday. HR forwards a tip from a teammate: the engineer said he was 'backing up his work' and has been in the office late.
947 words, about 5 min