OffSec Threat Hunter case studies
OffSec Threat Hunter · Put your knowledge to work in context.
The OffSec Threat Hunter (OSTH) certification validates foundational threat hunting skills on the defensive side of cybersecurity. It is earned by passing the exam associated with the TH-200 course, a Level 200 program with 54 hours of content organized into seven modules with hands-on labs and assessment questions. The OffSec Threat Hunter case studies are 5 cases and about 4,023 words.
1LockBit Claim vs. EDR Silence on a Segmented Finance VLAN
At 06:40 on Monday, a threat-intel feed reports that a LockBit affiliate has listed a 40 GB data theft claim against Northwind Financial on its leak site, with a 72-hour deadline. Northwind has 1,800 endpoints, CrowdStrike Falcon, Suricata at the internet edge, NetFlow, and a 60-host finance VLAN (10.20.0.0/24) with no direct internet access.
904 words, about 5 min2Beaconing in Proxy Logs After a CDN Change
Your team runs a 3.2-billion-event-per-day egress proxy dataset. A new hunting rule flags 47 internal hosts making an HTTPS POST every 300 seconds with about 8% jitter to /api/v2/collect on 12 domains registered within the last 40 days and fronted by the same CDN.
830 words, about 4 min3Suricata Inline Drop on Encrypted SMB
Suricata 6.0 runs inline on a 10 GbE span between the user VLAN and the data center. It loads 18,000 rules, 4% of packets are dropped, CPU sits at 78% at peak, and packet loss is 0.4%.
752 words, about 4 min4CLOP-Style File-Transfer Exploitation Without a CVE Match
An internet-facing file-transfer appliance in the DMZ was unpatched for nine days because the vendor patch broke a custom workflow. The appliance runs Windows Server with an EDR agent.
767 words, about 4 min5Falcon Credential-Dump Alert on a Domain Controller During Backup
At 01:10, Falcon raises a high-severity credential-dumping detection on DC-02. The process is rundll32.exe comsvcs.dll MiniDump, parent taskeng.exe, user svc backup, and the command line includes the LSASS PID with output to C:/Windows/Temp/bkp.dmp.
770 words, about 4 min