Investigation Scenario 🔎

An employee's Android phone recently made multiple connections to an IP address associated with prior malicious activity.

The /data/system/packages.xml file shows a recently installed APK named com[.]secure.update, signed with an unknown cert.

What do you look for to investigate whether an incident occurred and assess its impact?

Bonus Points: Mention which evidence sources you'd leverage to answer your questions

#InvestigationPath #DFIR #SOC

Abstraction simplifies complex data so we can process it quickly, but it also creates blind spots. We do this with domain names, timestamps, and all sorts of other fields. If your tool automatically drops certain fields or trims logs, you might be missing the full story

Metacognitive exercise: Next time you look at a dashboard or log output, ask yourself: What is this representation abstracted from? What assumptions am I making by looking at this instead of the raw data?

#DFIR #SOC

Good playbooks are not just mindless checklists; they are built on inductive reasoning. We observe patterns in specific attacks and generalize them to predict the right investigative questions for future incidents.

Playbooks are meant to augment human analysts and teach investigation strategies, not replace our critical thinking. The development of the playbooks is nearly as useful a process as using them.

#SOC #DFIR #InvestigationTheory

Investigation Scenario 🔎

A host on your network downloaded a file with this SHA256 hash: 9297af5f66486d11540f15b44d4b6beec6ff89dbc4dcdee898db9a7daaa76085

What do you look for to investigate whether the malware infected the host? You can only make two queries -- make them count.

#InvestigationPath #DFIR #SOC

Many of the same people who don't understand how analysts think are trying to tell AI how to do it and sell you the results. You shouldn't trust any of them.

I’m not anti-AI. It makes me a better analyst. I’m anti pretending that complex investigative reasoning can be reduced to prompts and dashboards by people who never understood the reasoning process to begin with. It's gonna continue to be a wild ride for a bit.

Investigation Scenario 🔎

You've discovered a user workstation with the Chrome Remote Desktop plugin installed. There's no business reason for the user to have this plugin, and they don't recall installing it.

What do you look for to investigate whether an incident occurred and the extent of its impact?

#InvestigationPath #DFIR #SOC