Mastodawn

Chris Sanders 🔎 🧠

@chrissanders88@infosec.exchange

1.9K Followers

378 Following

811 Posts

Security Analyst, Author, and Instructor, Ed.D.

Studying the intersection of security investigation doctrine, cognitive psychology, and education.

Founder of Applied Network Defense and Rural Tech Fund

Books:
🍯 Intrusion Detection Honeypots
🦈 Practical Packet Analysis
🌐 Applied Network Security Monitoring

Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor.

A question well stated is a problem half-solved. #InvestigationTheory

https://chrissanders.org/links/

Blog	https://chrissanders.org/
Training Courses	http://networkdefense.co/courses/
Twitter	https://twitter.com/chrissanders88
Books	https://chrissanders.org/publications
More Links	https://chrissanders.org/links/

Chris Sanders 🔎 🧠May 29

Last week, we launched a high-altitude balloon into the stratosphere. The payload included three Cube Satellite emulators built by rural classroom students we worked with. Their CubeSats collected real atmospheric data, which was returned to the classes for analysis. One of the neater projects we've done with Rural Tech Fund and our partner Teachers in Space. Check out these views from the balloon!

Chris Sanders 🔎 🧠May 9

This week, I had the joy of sharing my meteorite collection with two very different classrooms—one full of curious high schoolers and the other full of wide-eyed Pre-K explorers. The questions were wildly different (“How did our gravity capture this Martian rock?” vs. “Do you have a piece of the sun?"), but the wonder was the same.

There’s something magical about holding a piece of outer space in your hand—and it's even more magical watching someone discover that for the first time. 🚀☄️🌎

Chris Sanders 🔎 🧠Apr 2

Investigation Scenario 🔎

PowerShell Script Block Logging (EID 4104) reveals the pictured command was executed:

What do you look for to investigate whether an incident occurred and its extent?

#InvestigationPath #DFIR #SOC

Chris Sanders 🔎 🧠Mar 17

I'm delivering the closing Keynote at RejectionCon (virtually) this year. I'll talk a bit about my story, how poverty charges interest, and some of the ways we provide unique learning opportunities to students at the Rural Tech Fund.

Chris Sanders 🔎 🧠Feb 18

Space is so neat ☄️

Chris Sanders 🔎 🧠Feb 4

Investigation Scenario 🔎

You receive an alert that a Linux system is experiencing consistently high CPU usage. Running crontab -l for the related user, you see the pictured entry...

However, when you check again, the crontab entry is gone.

The file listed in the cron job is not currently available at that URL.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC