Chris Sanders 🔎 🧠

An IT mindset offers a lot of benefits to someone entering security. The mental models, troubleshooting habits, and systematic thinking developed in IT overlap meaningfully with the skills needed for security investigations.

But there are differences, too. One is how we think about automation.

We've got a new course releasing soon -- Browser Forensics for Security Analysts.

I'm looking for a couple of reviewers at different experience levels who'd like to go through the course and can do so relatively quickly! Send me a message if you're interested.

In your message, let me know how much overall DFIR experience you have, and how much work you've done in browser forensics specifically (and which browsers).

Do you ever think about when a friendship or relationship really begins? Maybe it’s when you first meet, or the first time you realize you genuinely enjoy being around each other.

But I think we often miss something... the first time you reminisce together about how you met or your early moments.

The more evidence sources you understand, the larger your investigative playing field becomes. As you understand how to think, you should also be expanding the field you operate in.

#SOC #DFIR #CyberSecurity

I was recently asked to advise on a product. The project lead showed me how his tool could take an alert, find the relevant data, and make investigative decisions based on what it found.

I gave the tool a Suricata alert to work through. It wasted a lot of effort, sent the analyst down rabbit holes, and failed to resolve the questions that mattered most.

I ask everyone who starts my Investigation Theory class, "What's a valuable trait or skill for an analyst to have?"

Many say "thinking outside the box"

And sometimes, unconventional solutions are exactly what’s needed.

But the pursuit of novelty can't be an excuse for ignorance of proven doctrine, either.

Sometimes we need folks thinking outside the box, but more often, we just need to understand the box better.

#DFIR #SOC #CyberSecurity

Investigation Scenario 🔎

Event ID 5136 on a DC shows msDS-KeyCredentialLink was modified on an old service account. No password reset occurred.

What do you examine next to determine who added the credential and whether it was used?

#InvestigationPath #DFIR #SOC

A whole bunch of people DM'd me about meeting Cliff Stoll in Vegas and I love that I've done things in my life that have folks wanting to share that specific joy with me. 💙😂 #cuckoosegg

Investigation Scenario 🔎

A user’s RecentDocs LNK file points to C:\Users\Public\Libraries\update.iso, mounted shortly before rundll32.exe launched update.dll from the new drive letter. The ISO is now gone.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

You received an alert that one of your honeydocs was opened on a network other than your own.

What do you look for to investigate whether an attacker exfiltrated this file from your network?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

While reviewing Amcache.hve, you notice C:\Users\Public\Libraries\SyncHost.exe executed once, but no corresponding Prefetch file exists despite Prefetch being enabled. The file is not present at that location.

What do you look for to investigate whether an incident occurred?

Bonus Exercise: List several of the potential explanations for this behavior

#InvestigationPath #DFIR #SOC

RE: https://infosec.exchange/@dougburks/116437559219680938

Doug built ANOTHER useful thing! I had a chance to play around with OhMyPCAP pre-release... super handy and worth having in your toolbox!

You always want to take the smallest slice of data necessary to answer an investigative question you're asking. It forces you to be focused and specific, while also limiting data processing time and resource utilization on your tools. I preach this frequently to my Investigation Theory students.

When you hear the word "identity" in cybersecurity, what does that mean to you? How do you define it?

Investigation Scenario 🔎

While investigating a potentially compromised host, you've discovered %LOCALAPPDATA%\Syncthing\config.xml. The user has no knowledge of ever using this application.

What do you look for to investigate whether the tool was used for malicious purposes?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

While investigating potential intellectual property theft, you discover the pictured registry artifact on a Windows 11 system.

The user claims they only connected a USB-C docking station.

What do you look for to investigate whether an incident occurred? Extra credit for focusing on the distinct order of operations you would take.

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

Windows Defender Event ID 5007 shows DisableRealtimeMonitoring changed from 0 to 1, yet MsMpEng.exe appears to still be running.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

While reviewing the ESXi hostd.log, an analyst spots a network file connection referencing a known VM disk, but at an unexpected path different from where it typically runs from:

/vmfs/volumes/BackupDS/temp/Finance01.vmdk

The production VMDK still exists in its normal datastore, but it no longer exists in the referenced path.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

A workstation’s $UsnJrnl shows a .lnk file created and deleted from %APPDATA%\Microsoft\Windows\Recent\ within 4 seconds, but the referenced file never appears in the MFT.

What do you look for next to determine what the user actually opened and whether malicious execution followed?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

Your SIEM alerted on mshta.exe spawning PowerShell, but an overly aggressive analyst reimaged the host before you could investigate. You only have Windows Event Logs (default config) and network sensor data. What do you look for to determine whether an incident occurred?

#InvestigationPath #DFIR #SOC