ECIH study guide

ECIH · Work through your exam, one topic at a time.

The EC-Council Certified Incident Handler (E CIH), currently offered as version 3, is a specialist credential focused on organizational incident handling and response. EC-Council positions it for mid-level to senior cybersecurity professionals with a minimum of one year of experience, and for information security practitioners who want to deepen their incident response skills. The ECIH study guide has 10 sections and about 3,826 words.

Introduction to Incident Handling and Response

An event is any observable occurrence in a system or network - a logon, a firewall block, a service starting. An adverse event is an event with a negative consequence (a crash, a failed disk).

373 words, about 2 min 02

Incident Handling and Response Process

Memorise the sequence and, more importantly, what belongs in each: Preparation (policy, team, tooling, communication plans, jump kits, training, baseline data), Identification (detection, validation, scoping, severity assignment, ticketing), Containment (stop the spread - short-term and long-term), Eradication (remove the root cause, delete malware, close the vulnerability, reset credentials), Recovery (restore systems to production, verify integrity, monitor closely), Lessons Learned (post-incident review, metrics, process and control improvements). Containment is not eradication.

391 words, about 2 min 03

First Response

A first responder protects people first , then property and evidence. Priorities in order: life and safety, preventing further damage, preserving evidence, documenting everything, and notifying the right people.

389 words, about 2 min 04

Handling and Responding to Malware Incidents

Be able to distinguish virus (needs a host and user action), worm (self-propagating across the network), trojan (disguised as legitimate), ransomware (encryption plus extortion, often double extortion), rootkit (kernel/user-mode stealth and persistence), spyware/keylogger , botnet agent , logic bomb , fileless malware (lives in memory, PowerShell/WMI, registry), and cryptominers . Ransomware affiliates and APT tooling rarely arrive alone: expect a dropper, a persistence mechanism and a C2 channel.

364 words, about 2 min 05

Handling and Responding to Email Security Incidents

Expect phishing , spear phishing (targeted), whaling (executives), clone phishing (a real thread replayed with swapped links), business email compromise (BEC, also called CEO fraud, often with no malware or URL at all), spoofing , malicious attachments (macros, ISO/LNK, HTML smuggling), credential-harvesting pages , thread hijacking , and mailbox rule abuse (auto-forwarding, hidden rules that hide replies). Read headers bottom-up along the Received chain to trace the actual path; remember the topmost Received line can be forged by the sender, so confirm the last trustworthy hop.

389 words, about 2 min 06

Handling and Responding to Network Security Incidents

DDoS (volumetric, protocol, application-layer), MITM including ARP poisoning and DNS spoofing , session hijacking , port scanning and reconnaissance , unauthorised access , rogue access points and evil twins , VLAN hopping , data exfiltration , and lateral movement inside the perimeter. Each has a distinct evidence source; naming the right source is half the answer.

369 words, about 2 min 07

Handling and Responding to Web Application Security Incidents

Map alerts to the OWASP Top 10 : broken access control, cryptographic failures, injection (SQL, NoSQL, OS command, LDAP), insecure design, security misconfiguration, vulnerable and outdated components, identification/authentication failures, software and data integrity failures (insecure deserialization, supply chain), logging and monitoring failures, and SSRF. Also know XSS (stored, reflected, DOM), CSRF, file inclusion (LFI/RFI), path traversal, and XML external entities.

399 words, about 2 min 08

Handling and Responding to Cloud Security Incidents

In IaaS the provider secures the physical layer, hypervisor and network fabric; the customer secures the OS, applications, identity and data. In PaaS more shifts to the provider; in SaaS the customer typically owns only identity, configuration and data.

374 words, about 2 min 09

Handling and Responding to Insider Threats

Negligent - well-meaning but careless: misfiled data, weak passwords, phishing victims. Usually handled with training and controls, not disciplinary action.

400 words, about 2 min 10

Handling and Responding to Endpoint Security Incidents

Incidents include malware and ransomware execution, unauthorised software, USB-borne compromise, privilege escalation, credential dumping, persistence installation and lateral movement. Know the telemetry each tool gives you: AV (signature and heuristics), EDR (process trees, command lines, module loads, network connections, remote-response shell), HIDS/HIPS , host firewall, application allow-listing, patch management, and Windows event logs.

378 words, about 2 min