Chris Sanders 🔎 🧠 ✓

@chrissanders88 · Mayfield KY ➡️ Gainesville GA · joined 30 Jul 2008

Ed.D. | Founder @networkdefense @RuralTechFund | Former @Mandiant, DoD | Author: Intrusion Detection Honeypots, Practical Packet Analysis, Applied NSM

35 691Followers

488Following

15 108Posts total

26.6KViews on collected posts

Derniers posts

Chris Sanders 🔎 🧠 ✓@chrissanders8810 Sep

@chrissanders88 Find the mshta execution through eventid 4688 then correlate around that time for any outbound connection, mostly the attacker would execute a remote hta script so it'll leave a dns query we can retrieve from the network sensor. We can also investigate fr ant bea 142 views · 5 likes · 0 reposts · 0 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders889 Sep

@chrissanders88 Outbound connections would be one thing. 367 views · 1 likes · 0 reposts · 1 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders889 Sep

@chrissanders88 T1218.005 Mshta proxied commands show via EID 4688 in WinEvt:Sec. The entire network telem is in-scope, but the timeline provided by that WinEvt telem can provide a strong starting point. ~30-40 min window for malicious schtask as second pass. Scale parsing for fu 371 views · 6 likes · 0 reposts · 1 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders889 Sep

Investigation Scenario 🔎 Your SIEM alerted on mshta.exe spawning PowerShell, but an overly aggressive analyst reimaged the host before you could investigate. You only have Windows Event Logs (default config) and network sensor data. What do you look for to determine whether an 6.2K views · 62 likes · 14 reposts · 6 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders883 Sep

@chrissanders88 I like people who have a 3rd grade outlook and keep asking Why? Until they basically can't ask it any more.. Sometimes you have to pull the thread until the sweater unravels...😂 😂 😂 48 views · 0 likes · 0 reposts · 0 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders882 Sep

Investigation Scenario 🔎 A user’s RecentDocs LNK file points to C:\Users\Public\Libraries\update.iso, mounted shortly before rundll32.exe launched update.dll from the new drive letter. The ISO is now gone. What do you look for to investigate whether an incident occurred? 3.7K views · 36 likes · 8 reposts · 5 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders881 Sep

@chrissanders88 I think the most valuable skill is curiosity. Which I would argue first helps you define the box, and then discover the holes in the box. 253 views · 2 likes · 0 reposts · 1 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders881 Sep

@chrissanders88 I approve of this statement. 261 views · 2 likes · 0 reposts · 0 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders881 Sep

I ask everyone who starts my Investigation Theory class, "What's a valuable trait or skill for an analyst to have?" Many say "thinking outside the box" And sometimes, unconventional solutions are exactly what’s needed. But the pursuit of novelty can't be an excuse for 10.6K views · 86 likes · 20 reposts · 7 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders8825 Aug

Investigation Scenario 🔎 While investigating a potentially compromised host, you've discovered %LOCALAPPDATA%\Syncthing\config.xml. The user has no knowledge of ever using this application. What do you look for to investigate whether the tool was used for malicious purposes? 4.8K views · 33 likes · 7 reposts · 4 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders8819 Nov 2022

Hi, Y'all! I tweet about the intersection of cyber security investigation doctrine, cognitive psychology, and education. Also BBQ. 👨🏻‍🏫 Online Courses I Teach: https://t.co/htkrzd8C7m 📚 Books I've Written: https://t.co/vGT2gc1IY9 🌎 Blog & More Links: https://t.co/crPRmaj2hB 0 views · 131 likes · 30 reposts · 8 replies Open on X →

Face aux comptes de taille comparable

10 posts des 90 derniers jours, à côté de la tranche de 10K–100K abonnés. en dessous de ses pairs à la fois en portée et en engagement.

Vues médianes369ce compte940médiane pour 10K–100K

Portée, %1.03%ce compte3.45%médiane pour 10K–100K

Engagement, %1.13%ce compte1.55%médiane pour 10K–100K

Indicateur	Ce compte	Médiane pour 10K–100K	Rapport
Vues médianes par post	369	940	0.39×
Portée (vues ÷ abonnés)	1.03%	3.45%	0.30×
Taux d'engagement	1.13%	1.55%	0.73×

Autres comptes de cette tranche → Comparer avec un autre compte → Comment ces repères sont établis →

Growth & engagement

How the posts we collected actually performed: views and reaction rate post by post, what the audience did with them, and where the follower count goes.

Views per post

4.8K25 Aug

10.6K1 Sep

261

253

3.7K2 Sep

483 Sep

6.2K9 Sep

371

367

14210 Sep

Last 10 collected posts, oldest on the left. The scale is logarithmic: one post can outrun the rest a hundred times over.

Engagement rate per post

0.93%25 Aug

1.07%1 Sep

0.77%

1.19%

1.34%2 Sep

0.00%3 Sep

1.32%9 Sep

1.89%

0.54%

3.52%10 Sep

Reactions — likes, reposts, replies and quotes — divided by views. Median for 10K–100K accounts is 1.55%.

What the audience does

Likes57.7%233 in total

Reposts12.1%49 in total

Replies6.2%25 in total

Bookmarks24.0%97 in total

Share of every reaction we collected for this account. Replies mean argument, reposts mean endorsement, bookmarks mean the post was worth keeping.

The follower curve appears once this account has two daily snapshots — we take one a day, and this one is on its first.

Derniers posts

Face aux comptes de taille comparable

Growth & engagement

Views per post

Engagement rate per post

What the audience does

Comptes similaires