Investigation Scenario 🔎 While reviewing Amcache.hve, you notice C:\Users\Public\Libraries\SyncHost.exe executed once, but no corresponding Prefetch file exists despite Prefetch being enabled. The file is not present at that location.

This may be a hot take, but a senior title should recognize someone who consistently applies broad experience, sound judgment, and nuanced perspective across a wide range of situations... not just someone who possesses a rare or in-demand technical skill at the time.

Investigation Scenario 🔎 Alert: Microsoft Defender for Endpoint: Behavior:Win32/SuspClickFix.F detected on a Windows 11 workstation. No additional context is provided. What artifacts would you examine first to determine whether the user executed the ClickFix command?

Call it what you like, but this is a rural tax from USPS. People in rural communities already have fewer local shopping options and rely more heavily on mail delivery. Making lightweight packages more expensive to send there seems antithetical to the idea of this public service.

In a recent study, those who actively planned, monitored, and critiqued their thinking (aka higher metacognitive skills) used LLMs more effectively and produced more creative work. Thinking about thinking has never mattered more.

Investigation Scenario 🔎 A Windows 11 workstation’s Microsoft-Windows-TaskScheduler/Operational log contains Event ID 106, indicating a new scheduled task named "OneDrive Update Service" was registered at 5:45 PM local time. The user insists they were away from the computer when this happened.

You always want to take the smallest slice of data necessary to answer an investigative question you're asking. It forces you to be focused and specific, while also limiting data processing time and resource utilization on your tools. I preach this frequently to my Investigation Theory students.

"Show your work." When I was in school, kids would get mad when teachers would ask them that. "What does it matter so long as I get the right answer?"

Investigation Scenario 🔎 You’ve found ~/.config/systemd/user/dbus-update.service enabled for a user account on an Ubuntu system. The service executes ~/.local/bin/dbus-update, an ELF binary that isn’t owned by any installed package.

I was on vacation, so no Investigation Scenario this week. Spend your time investigating some lemonade and hot dogs!

One thing I wish I could relay more to learners and teachers alike... The better you know a subject, the harder it is to imagine what it is like for someone else not to know it. That's a curse of knowledge. It's hard to remember what it was like when you didn't know that thing.

Investigation Scenario 🔎 An LLM has reviewed domain authentication logs and suggested that an account is likely compromised, based on several successful authentication clusters that occurred frequently over the past week. What do you look for to investigate whether an incident occurred?

With all the recent M&A activity and more certainly to come, I keep arriving back at the same question... are people going to be safer?

Investigation Scenario 🔎 While hunting, you identify an outlier host with a Windows Prefetch file named RUNDLL32.EXE-3F2A9B1C[.]pf The file shows a run count significantly higher than the baseline observed across the environment, with multiple recorded execution timestamps occurring overnight.

I use LLMs for a variety of tasks every day and frequently benchmark domain-specific tasks across different models for my research. So, where am I on LLM use for security analysis and investigation work? In short summary:

Investigation Scenario 🔎 You've discovered a Sysmon log (EID 13) showing reg.exe writing a value into the HKCU\Software\firm\soft\Name registry key. What do you look for to investigate whether an incident occurred and the extent of its impact? #InvestigationPath #DFIR #SOC

Good analysts understand the importance of data perspective... changing their altitude! They zoom in to examine the elements of individual events or zoom out to consider a series of related events.

"...repeated exposure to information has a more profound influence on people's beliefs in settings where people actively choose which information they are exposed to." pubmed.ncbi.nlm.nih.gov/41505278/

Investigation Scenario 🔎 You notice Event ID 7040 in the System log. The startup type of the Remote Registry service changed from Disabled to Manual for 14 minutes, then back to Disabled. No corresponding service-install events exist.

Most highly effective analysts don't just read logs; they mentally map out the network and visualize the attack as physical movement. They conceptualize functional boundaries and the attack surface available at any given foothold (even if they don't realize they're doing it).

Investigation Scenario 🔎 An employee's Android phone recently made multiple connections to an IP address associated with prior malicious activity. The /data/system/packages.xml file shows a recently installed APK named com[.]secure.update, signed with an unknown cert.

I'll be speaking about our work @RuralTechFund. Looking forward to seeing folks there.

Abstraction simplifies complex data so we can process it quickly, but it also hides data and creates blind spots. We do this with domain names, timestamps, and all sorts of other fields. If your tool automatically drops certain fields or trims logs, you might be missing the full story

Good playbooks are not just mindless checklists; they are built on inductive reasoning. We observe patterns in specific attacks and generalize them to predict the right investigative questions for future incidents.

Investigation Scenario 🔎 A host on your network downloaded a file with this SHA256 hash: 9297af5f66486d11540f15b44d4b6beec6ff89dbc4dcdee898db9a7daaa76085 What do you look for to investigate whether the malware infected the host? You can only make two queries -- make them count.

Many of the same people who don't understand how analysts think are trying to tell AI how to do it and sell you the results. You shouldn't trust any of them.

Investigation Scenario 🔎 You've discovered a user workstation with the Chrome Remote Desktop plugin installed. There's no business reason for the user to have this plugin, and they don't recall installing it.

Launching attacks against Canvas at the most critical point of the school year harms students and adds even more strain to teachers already carrying an extraordinary burden for salaries that are far too low for the work they do.

Investigation Scenario 🔎 While creating new user accounts in Active Directory, you find that several legitimate user accounts with no apparent connection are part of an undocumented group named "test".

Investigation Scenario 🔎 A high-level company exec received an email that someone logged into their social media account from a country they were not in. The exec noted that they use the same password in several places.