Chris Sanders 🔎 🧠 ✓

@chrissanders88 · Mayfield KY ➡️ Gainesville GA · joined 30 Jul 2008

Ed.D. | Founder @networkdefense @RuralTechFund | Former @Mandiant, DoD | Author: Intrusion Detection Honeypots, Practical Packet Analysis, Applied NSM

35 691Followers

488Following

15 108Posts total

26.6KViews on collected posts

Ultimi post

Chris Sanders 🔎 🧠 ✓@chrissanders8810 Sep

@chrissanders88 Find the mshta execution through eventid 4688 then correlate around that time for any outbound connection, mostly the attacker would execute a remote hta script so it'll leave a dns query we can retrieve from the network sensor. We can also investigate fr ant bea 142 views · 5 likes · 0 reposts · 0 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders889 Sep

@chrissanders88 Outbound connections would be one thing. 367 views · 1 likes · 0 reposts · 1 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders889 Sep

@chrissanders88 T1218.005 Mshta proxied commands show via EID 4688 in WinEvt:Sec. The entire network telem is in-scope, but the timeline provided by that WinEvt telem can provide a strong starting point. ~30-40 min window for malicious schtask as second pass. Scale parsing for fu 371 views · 6 likes · 0 reposts · 1 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders889 Sep

Investigation Scenario 🔎 Your SIEM alerted on mshta.exe spawning PowerShell, but an overly aggressive analyst reimaged the host before you could investigate. You only have Windows Event Logs (default config) and network sensor data. What do you look for to determine whether an 6.2K views · 62 likes · 14 reposts · 6 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders883 Sep

@chrissanders88 I like people who have a 3rd grade outlook and keep asking Why? Until they basically can't ask it any more.. Sometimes you have to pull the thread until the sweater unravels...😂 😂 😂 48 views · 0 likes · 0 reposts · 0 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders882 Sep

Investigation Scenario 🔎 A user’s RecentDocs LNK file points to C:\Users\Public\Libraries\update.iso, mounted shortly before rundll32.exe launched update.dll from the new drive letter. The ISO is now gone. What do you look for to investigate whether an incident occurred? 3.7K views · 36 likes · 8 reposts · 5 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders881 Sep

@chrissanders88 I think the most valuable skill is curiosity. Which I would argue first helps you define the box, and then discover the holes in the box. 253 views · 2 likes · 0 reposts · 1 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders881 Sep

@chrissanders88 I approve of this statement. 261 views · 2 likes · 0 reposts · 0 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders881 Sep

I ask everyone who starts my Investigation Theory class, "What's a valuable trait or skill for an analyst to have?" Many say "thinking outside the box" And sometimes, unconventional solutions are exactly what’s needed. But the pursuit of novelty can't be an excuse for 10.6K views · 86 likes · 20 reposts · 7 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders8825 Aug

Investigation Scenario 🔎 While investigating a potentially compromised host, you've discovered %LOCALAPPDATA%\Syncthing\config.xml. The user has no knowledge of ever using this application. What do you look for to investigate whether the tool was used for malicious purposes? 4.8K views · 33 likes · 7 reposts · 4 replies Open on X →

Chris Sanders 🔎 🧠 ✓@chrissanders8819 Nov 2022

Hi, Y'all! I tweet about the intersection of cyber security investigation doctrine, cognitive psychology, and education. Also BBQ. 👨🏻‍🏫 Online Courses I Teach: https://t.co/htkrzd8C7m 📚 Books I've Written: https://t.co/vGT2gc1IY9 🌎 Blog & More Links: https://t.co/crPRmaj2hB 0 views · 131 likes · 30 reposts · 8 replies Open on X →

Rispetto ad account della stessa dimensione

10 post degli ultimi 90 giorni, accanto alla fascia di 10K–100K follower. sotto i pari sia per copertura sia per interazione.

Visualizzazioni mediane369questo account949mediana per 10K–100K

Copertura, %1.03%questo account3.49%mediana per 10K–100K

Interazione, %1.13%questo account1.55%mediana per 10K–100K

Metrica	Questo account	Mediana per 10K–100K	Rapporto
Visualizzazioni mediane per post	369	949	0.39×
Copertura (visualizzazioni ÷ follower)	1.03%	3.49%	0.30×
Tasso di interazione	1.13%	1.55%	0.73×

Altri account di questa fascia → Confronta con un altro account → Come sono costruiti questi parametri →

Growth & engagement

How the posts we collected actually performed: views and reaction rate post by post, what the audience did with them, and where the follower count goes.

Views per post

4.8K25 Aug

10.6K1 Sep

261

253

3.7K2 Sep

483 Sep

6.2K9 Sep

371

367

14210 Sep

Last 10 collected posts, oldest on the left. The scale is logarithmic: one post can outrun the rest a hundred times over.

Engagement rate per post

0.93%25 Aug

1.07%1 Sep

0.77%

1.19%

1.34%2 Sep

0.00%3 Sep

1.32%9 Sep

1.89%

0.54%

3.52%10 Sep

Reactions — likes, reposts, replies and quotes — divided by views. Median for 10K–100K accounts is 1.55%.

What the audience does

Likes57.7%233 in total

Reposts12.1%49 in total

Replies6.2%25 in total

Bookmarks24.0%97 in total

Share of every reaction we collected for this account. Replies mean argument, reposts mean endorsement, bookmarks mean the post was worth keeping.

The follower curve appears once this account has two daily snapshots — we take one a day, and this one is on its first.

Ultimi post

Rispetto ad account della stessa dimensione

Growth & engagement

Views per post

Engagement rate per post

What the audience does

Account simili