Hi, Y'all! I tweet about the intersection of cyber security investigation doctrine, cognitive psychology, and education. Also BBQ. 👨🏻‍🏫 Online Courses I Teach: networkdefense.co/courses/ 📚 Books I've Written: chrissanders.org/publication… 🌎 Blog & More Links: chrissanders.org/links/

If your head is spinning with all the recent security news, and dealing with new vulnerabilities, and LLM jive turkeyism, and shifting employment landscape, and it all feels unsustainable... that's because it is.

Shout out Ben for participating in this week’s investigation scenario

Investigation Scenario 🔎 A user received this SMS: “UPS: Package Delivery Failed. Update your address.” Browser history shows a visit to a fake UPS site, followed by a POST request to /api/verify. What do you look for to investigate whether an incident occurred? (Your choice on phone OS) #InvestigationPath #DFIR #SOC

Investigation Scenario 🔎 An analyst examining Chrome’s History database discovers a redirect leading from a legitimate document-sharing service to an unfamiliar domain that open source intelligence identifies as being associated with credential phishing. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC

An IT mindset offers a lot of benefits to someone entering security. The mental models, troubleshooting habits, and systematic thinking developed in IT overlap meaningfully with the skills needed for security investigations. But there are differences, too. One is how we think about automation. In IT, automation often drives the work. Many tasks are deterministic, and we can anticipate their failure modes, test them, and engineer around them. If you can reliably automate a process, that’s usually a win. Security investigations are different. They involve ambiguity, incomplete evidence, unpredictable failure modes, changing context, and frequent judgment calls. The number of ways an investigation can go sideways is much harder to constrain. That doesn’t mean we shouldn’t automate. We absolutely should automate the parts of investigative work that lend themselves to it. But, automation isn’t the goal. The goal is to make good decisions and not miss important things. Automation should serve those goals, not compete with them. As LLMs increasingly find their way into security products, I think this distinction becomes even more important. I see that IT mindset driving some security products, and that can lead folks down the wrong path. We can’t sacrifice investigative quality just to say we’ve automated more of the investigation. The stakes are too high.

Investigation Scenario 🔎 While reviewing the ESXi hostd.log, an analyst spots a network file connection referencing a known VM disk, but at an unexpected path different from where it typically runs from: /vmfs/volumes/BackupDS/temp/Finance01.vmdk The production VMDK still exists in its normal datastore, but it no longer exists in the referenced path. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC

Do you ever think about when a friendship or relationship really begins? Maybe it’s when you first meet, or the first time you realize you genuinely enjoy being around each other. But I think we often miss something... the first time you reminisce together about how you met or your early moments. What the other person was wearing. How nervous or awkward you were. What you ate. The dumb jokes you made. Your first impressions of each other. The little details one of you remembers that the other had already forgotten. There’s something magical about that moment. You’re taking two separate memories of the same event and turning them into a shared story... co-writing a narrative of your past, together. I suppose that all may seem irrelevant to digital forensics, but ultimately, we're in this business for the people, the relationships we form, and the others we help protect.

We've got a new course releasing soon -- Browser Forensics for Security Analysts. I'm looking for a couple of reviewers at different experience levels who'd like to go through the course and can do so relatively quickly! Send me a message if you're interested. In your message, let me know how much overall DFIR experience you have, and how much work you've done in browser forensics specifically (and which browsers).

The more evidence sources you understand, the larger your investigative playing field becomes. As you understand how to think, you should also be expanding the field you operate in. #SOC #DFIR #CyberSecurity

One of our classrooms took their project all the way to Iceland! One heck of a journey!

I was recently asked to advise on a product. The project lead showed me how his tool could take an alert, find the relevant data, and make investigative decisions based on what it found. I gave the tool a Suricata alert to work through. It wasted a lot of effort, sent the analyst down rabbit holes, and failed to resolve the questions that mattered most. So, I gave the same alert to the product lead and asked him to list the investigative questions he would pursue. The list he gave me wasn't very good either. It turns out that when you don't have the ability to evaluate investigative actions effectively, you can't build products or train LLMs effectively for that task either. Tools can make you a better analyst, but you have to be metacognitively aware enough to know where they fit in, where they have limits, and where it all might lead you astray. #DFIR #SOC #CyberSecurity

Investigation Scenario 🔎 Event ID 5136 on a DC shows msDS-KeyCredentialLink was modified on an old service account. No password reset occurred. What do you examine next to determine who added the credential and whether it was used? #InvestigationPath #DFIR #SOC

I’ve taken a surprising number of calls lately from people wanting to understand how human reasoning differs from machine inference. How do analysts reason through uncertainty? How do we form hypotheses? What makes us notice one piece of evidence and ignore another? Where does intuition come from? How are human judgment and machine inference fundamentally different? The more we try to understand what LLMs can and can’t do effectively, the more we’re forced to examine the cognitive processes we’ve traditionally taken for granted in ourselves. Among many who embrace it, that's leading to greater metacognitive awareness... people becoming more conscious of how they reason, not just what conclusions they reach. #DFIR #AI #LLM #Metacognition