← Feed

Posts

• View post

  Investigation Scenario 🔎 Event ID 5136 on a DC shows msDS-KeyCredentialLink was modified on an old service account. No password reset occurred. What do you examine next to determine who added the credential and whether it was used? #InvestigationPath #DFIR #SOC

• View post

  I was recently asked to advise on a product. The project lead showed me how his tool could take an alert, find the relevant data, and make investigative decisions based on what it found. I gave the tool a Suricata alert to work through. It wasted a lot of effort, sent the analyst down rabbit holes, and failed to resolve the questions that mattered most.

• View post

  Investigation Scenario 🔎 Windows Defender Event ID 5007 shows DisableRealtimeMonitoring changed from 0 to 1, yet MsMpEng.exe appears to still be running. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC

• View post

  The more evidence sources you understand, the larger your investigative playing field becomes. As you understand how to think, you should also be expanding the field you operate in. #SOC #DFIR #CyberSecurity

• View post

  We've got a new course releasing soon -- Browser Forensics for Security Analysts. I'm looking for a couple of reviewers at different experience levels who'd like to go through the course and can do so relatively quickly! Send me a message if you're interested. In your message, let me know how much overall DFIR experience you have, and how much work you've done in browser forensics specifically (and which browsers).

• View post

  Do you ever think about when a friendship or relationship really begins? Maybe it’s when you first meet, or the first time you realize you genuinely enjoy being around each other. But I think we often miss something... the first time you reminisce together about how you met or your early moments.

• View post

  Investigation Scenario 🔎 While reviewing the ESXi hostd.log, an analyst spots a network file connection referencing a known VM disk, but at an unexpected path different from where it typically runs from: /vmfs/volumes/BackupDS/temp/Finance01.vmdk The production VMDK still exists in its normal datastore, but it no longer exists in the referenced path. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC

• View post

  An IT mindset offers a lot of benefits to someone entering security. The mental models, troubleshooting habits, and systematic thinking developed in IT overlap meaningfully with the skills needed for security investigations. But there are differences, too. One is how we think about automation.

• View post

  I’ve taken a surprising number of calls lately from people wanting to understand how human reasoning differs from machine inference. How do analysts reason through uncertainty? How do we form hypotheses? What makes us notice one piece of evidence and ignore another? Where does intuition come from? How are human judgment and machine inference fundamentally different?

• View post

  I read CISA’s new report on using cyber decoys to strengthen detection and response, and it’s very philosophically aligned with the work I’ve done on Intrusion Detection Honeypots (IDHs). I’ve been beating this drum for years: properly deployed internal honeypots are one of the best bargains in detection. #DFIR #IDS #Honeypots

• View post

  Investigation Scenario 🔎 A user’s RecentDocs LNK file points to C:\Users\Public\Libraries\update.iso, mounted shortly before rundll32.exe launched update.dll from the new drive letter. The ISO is now gone. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC

• View post

  Investigation Scenario 🔎 Your SIEM alerted on mshta.exe spawning PowerShell, but an overly aggressive analyst reimaged the host before you could investigate. You only have Windows Event Logs (default config) and network sensor data. What do you look for to determine whether an incident occurred? #InvestigationPath #DFIR #SOC

• View post

  Investigation Scenario 🔎 A workstation’s $UsnJrnl shows a .lnk file created and deleted from %APPDATA%\Microsoft\Windows\Recent\ within 4 seconds, but the referenced file never appears in the MFT. What do you look for next to determine what the user actually opened and whether malicious execution followed? #InvestigationPath #DFIR #SOC

• View post

  You always want to take the smallest slice of data necessary to answer an investigative question you're asking. It forces you to be focused and specific, while also limiting data processing time and resource utilization on your tools. I preach this frequently to my Investigation Theory students.

• View post

  Investigation Scenario 🔎 While reviewing Amcache.hve, you notice C:\Users\Public\Libraries\SyncHost.exe executed once, but no corresponding Prefetch file exists despite Prefetch being enabled. The file is not present at that location. What do you look for to investigate whether an incident occurred? Bonus Exercise: List several of the potential explanations for this behavior #InvestigationPath #DFIR #SOC

• View post

  A whole bunch of people DM'd me about meeting Cliff Stoll in Vegas and I love that I've done things in my life that have folks wanting to share that specific joy with me. 💙😂 #cuckoosegg

• View post

  Investigation Scenario 🔎 You received an alert that one of your honeydocs was opened on a network other than your own. What do you look for to investigate whether an attacker exfiltrated this file from your network? #InvestigationPath #DFIR #SOC

• View post

  Investigation Scenario 🔎 While investigating potential intellectual property theft, you discover the pictured registry artifact on a Windows 11 system. The user claims they only connected a USB-C docking station. What do you look for to investigate whether an incident occurred? Extra credit for focusing on the distinct order of operations you would take. #InvestigationPath #DFIR #SOC

• View post

  Investigation Scenario 🔎 While investigating a potentially compromised host, you've discovered %LOCALAPPDATA%\Syncthing\config.xml. The user has no knowledge of ever using this application. What do you look for to investigate whether the tool was used for malicious purposes? #InvestigationPath #DFIR #SOC

• View post

  I ask everyone who starts my Investigation Theory class, "What's a valuable trait or skill for an analyst to have?" Many say "thinking outside the box" And sometimes, unconventional solutions are exactly what’s needed. But the pursuit of novelty can't be an excuse for ignorance of proven doctrine, either. Sometimes we need folks thinking outside the box, but more often, we just need to understand the box better. #DFIR #SOC #CyberSecurity

• View post

  This may be a hot take, but a senior title should recognize someone who consistently applies broad experience, sound judgment, and nuanced perspective across a wide range of situations... not just someone who possesses a rare or in-demand technical skill at the time.

• View post

  Investigation Scenario 🔎 Alert: Microsoft Defender for Endpoint: Behavior:Win32/SuspClickFix.F detected on a Windows 11 workstation. No additional context is provided. What artifacts would you examine first to determine whether the user executed the ClickFix command? To go further, what would you look for to determine whether the alert represents the beginning of an ACR Stealer intrusion? #InvestigationPath #DFIR #SOC

• View post

  Call it what you like, but this is a rural tax from USPS. People in rural communities already have fewer local shopping options and rely more heavily on mail delivery. Making lightweight packages more expensive to send there seems antithetical to the idea of this public service.

• View post

  In a recent study, those who actively planned, monitored, and critiqued their thinking (aka higher metacognitive skills) used LLMs more effectively and produced more creative work. Thinking about thinking has never mattered more.

• View post

  Investigation Scenario 🔎 A Windows 11 workstation’s Microsoft-Windows-TaskScheduler/Operational log contains Event ID 106, indicating a new scheduled task named "OneDrive Update Service" was registered at 5:45 PM local time. The user insists they were away from the computer when this happened. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC

• View post

  "Show your work." When I was in school, kids would get mad when teachers would ask them that. "What does it matter so long as I get the right answer?" Showing your work has always been the essential lesson, because eventually, someone will tell you that you’re wrong. If you can’t explain how you reached your conclusion, you can’t defend it. Your value isn’t just producing an answer... It’s being able to explain, defend, and adapt your reasoning. It's never been more v...

• View post

  Investigation Scenario 🔎 You’ve found ~/.config/systemd/user/dbus-update.service enabled for a user account on an Ubuntu system. The service executes ~/.local/bin/dbus-update, an ELF binary that isn’t owned by any installed package. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC

• View post

  RE: https://infosec.exchange/@dougburks/116437559219680938 Doug built ANOTHER useful thing! I had a chance to play around with OhMyPCAP pre-release... super handy and worth having in your toolbox!

• View post

  When you hear the word "identity" in cybersecurity, what does that mean to you? How do you define it?

• View post

  "...the propensity for prosocial behavior may be reduced in states of cognitive fatigue resulting from the extended exertion of self-control." similar to "sleep-like activity" Prolonged cognitive fatigue ➡️ frontal cortex changes ➡️ more aggressive and uncooperative