CTDC case studies
CTDC · Put your knowledge to work in context.
The Certified Threat Detection and Countermeasures (CTDC) credential is aimed at security operations practitioners who detect, triage, and respond to intrusions rather than at governance or audit roles. Typical candidates are SOC analysts moving from tier-one alert handling to deeper investigation, detection engineers, incident responders, and network or endpoint administrators who share on-call rotation duties. The CTDC case studies are 5 cases and about 5,077 words.
1Sustained TXT Queries from a Finance Workstation
At a 1,800-endpoint manufacturer, Zeek DNS logs and the internal resolver feed a SIEM. A scheduled hunt surfaces WS-4471, a finance workstation whose user has been on leave for two weeks, issuing roughly 9,400 DNS queries in six hours - about 26 per minute, sustained.
1,057 words, about 5 min2LSASS Dump on a Shared Jump Host
At 03:12, EDR on JUMP-02 - a Windows jump host used around the clock by on-call administrators - alerts on rundll32.exe loading comsvcs.dll and calling MiniDump against lsass.exe (PID 712), writing C: 2024.dmp. The parent is a PSEXESVC service created four minutes earlier; the running account is svc backup, a domain service account with local administrator rights on 40 servers.
924 words, about 5 min3Three Feeds, One Lookup Table, 18,400 Alerts
Your SOC ingests three indicator sources: a commercial feed (120,000 indicators, 60-day retention), a free OSINT aggregation (45,000, no expiry dates at all), and a sector ISAC feed (2,000, high confidence, roughly 12-hour relevance). All three write into one SIEM lookup table keyed on IP, domain, and SHA-256, matched against proxy, DNS, and EDR telemetry.
995 words, about 5 min41,100 PowerShell Alerts a Day, Five Days Before Change Freeze
A new SIEM rule, 'Suspicious PowerShell Execution', alerts whenever a process command line contains -enc, -EncodedCommand, -nop, or -w hidden. It fires about 1,100 times a day across 12,000 endpoints.
1,007 words, about 5 min502:07 Saturday: Domain Admin on Three Servers and 1.2 GB Leaving
A tier-1 analyst on the overnight shift sees a correlated alert: domain admin account da-ops2 authenticated to three servers (APP-03, SQL-02, FS-01) within four minutes, and none of those servers has a record of da-ops2 in the previous 90 days. EDR on SQL-02 shows net.exe group /domain, nltest /dclist, and a PowerShell process writing a 300 MB archive to C: .
1,094 words, about 5 min