CNFE case studies
CNFE · Put your knowledge to work in context.
The Certified Network Forensic Examiner (CNFE) credential is aimed at practitioners who investigate security incidents from the network side: analysts, incident responders, and forensic examiners who need to reconstruct what happened on a wire rather than on a disk. It suits people who already understand TCP/IP and packet analysis and want a structured way to demonstrate that skill in investigations, litigation support, or expert-witness work. The CNFE case studies are 5 cases and about 3,203 words.
1VPN Capture of a Departing Employee in Munich
A U.S.-headquartered software company suspects a Munich-based sales engineer of downloading customer contracts before resigning. The SOC enables full-packet capture for 72 hours at the VPN concentrator using the filter host 10.20.33.41 and port 443, collecting 9.4 GB.
675 words, about 3 min2DNS TXT Burst in the Finance Subnet
Over eight hours, a sensor records 14,600 DNS queries from 10.44.7.0/24 to ns1.telemetry-sync[.]net, an authoritative server registered 11 days ago. Of these, 11,300 are TXT queries with labels 45-63 characters, 78% unique; response payloads are 220-255 bytes.
621 words, about 3 min3Dropped Packets on a 10 Gbps Incident Capture
You are called to a suspected ransomware intrusion at a 10 Gbps core link. The only available tap is a SPAN port on a switch that aggregates four 1 Gbps access links.
653 words, about 3 min4Suricata Alert Surge After a Rule Update
After a signature update, Suricata generates 4,120 alerts in 30 minutes. A total of 3,870 are SID 2024897, ET EXPLOIT Possible Apache Struts RCE, all sourced from 10.10.4.15 to 140 internal web servers on port 8080.
620 words, about 3 min5Periodic HTTPS Beacons and SMB Lateral Movement
Proxy logs for 1,200 endpoints show 47 hosts making HTTPS POSTs every 60 seconds with plus or minus 10% jitter to cdn.telemetry-edge[.]net, URI path /api/v2/checkin. The domain resolves to 203.0.113.88 and is fronted by a legitimate CDN.
634 words, about 3 min