HTB CDSA case studies
HTB CDSA · Put your knowledge to work in context.
The HTB Certified Defensive Security Analyst (CDSA) is a hands-on credential aimed at people who investigate and contain intrusions rather than launch them: SOC analysts, blue-team engineers, incident responders, and forensic examiners who want evidence that they can work a live environment under pressure. The exam is delivered as a practical engagement in real infrastructure, and candidates document their findings in a written report, so it tests both technical execution and the communication skills a defensive role demands daily. The HTB CDSA case studies are 5 cases and about 3,117 words.
1Web Server Beacon During a Change Freeze
At 03:12 on a Saturday, an EDR alert fires on IIS-PROD-07, one of 60 internet-facing web servers. The alert shows w3wp.exe spawning powershell.exe with a Base64-encoded command; the PowerShell process then makes an outbound TLS connection to 45.77.12.9:443 every 60 seconds.
662 words, about 3 min2Service Account RDP Logon Outside Backup Window
A SIEM rule alerts when a single account produces at least ten 4625 failures followed by a 4624 success within five minutes. At 13:22, svc backup triggers it: 14 failures against DC-02 from 10.20.30.44, then a successful 4624 type 10.
627 words, about 3 min3IDS Beacon Alert Mixes Red-Team and User Hosts
Your IDS sensors cover a 1 Gbps internet edge and generate about 8,000 alerts per day. A new signature, 'Possible Cobalt Strike Beacon', fires 400 times in 24 hours from 20 internal hosts to three external IPs on TCP 443.
628 words, about 3 min4LSASS Access from a Phishing Attachment
At 10:05, EDR alerts on LSASS access by an unsigned binary named update.exe running from C: . The parent process is outlook.exe, and the user mchen says she opened an invoice attachment 20 minutes earlier.
579 words, about 3 min5Ransomware on a Powered-Off BitLocker Laptop
A finance employee reports that her Windows 10 laptop will not open documents and shows a note named READ ME.txt demanding payment in Monero. Files now have the extension .locked, and the user powered the laptop off before calling the help desk.
621 words, about 3 min