Nostr notes by Chris Sanders 🔎 🧠

Investigation Scenario 🔎 Alert: Microsoft Defender for ...

2026-07-21T14:08:16Z

Investigation Scenario 🔎

Alert: Microsoft Defender for Endpoint: Behavior:Win32/SuspClickFix.F detected on a Windows 11 workstation.

No additional context is provided. What artifacts would you examine first to determine whether the user executed the ClickFix command?

To go further, what would you look for to determine whether the alert represents the beginning of an ACR Stealer intrusion?

#InvestigationPath #DFIR #SOC

"Show your work." When I was in school, kids would get ...

2026-07-09T15:15:25Z

"Show your work."

When I was in school, kids would get mad when teachers would ask them that. "What does it matter so long as I get the right answer?"

Showing your work has always been the essential lesson, because eventually, someone will tell you that you’re wrong. If you can’t explain how you reached your conclusion, you can’t defend it.

Your value isn’t just producing an answer... It’s being able to explain, defend, and adapt your reasoning.

It's never been more valuable than now.

I promise this isn't focused on any one specific company; you ...

2026-06-19T13:38:54Z

In reply to nevent1q…4wqw
_________________________

I promise this isn't focused on any one specific company; you can call it my naive idealism if nothing else.

With all the recent M&A activity and more certainly to come, ...

2026-06-19T13:38:54Z

With all the recent M&A activity and more certainly to come, I keep arriving back at the same question... are people going to be safer?

I use LLMs for a variety of tasks every day and frequently ...

2026-06-11T14:14:57Z

I use LLMs for a variety of tasks every day and frequently benchmark domain-specific tasks across different models for my research. So, where am I on LLM use for security analysis and investigation work? In short summary:

Many of the same people who don't understand how analysts ...

2026-05-14T14:47:56Z

Many of the same people who don't understand how analysts think are trying to tell AI how to do it and sell you the results. You shouldn't trust any of them.

I’m not anti-AI. It makes me a better analyst. I’m anti pretending that complex investigative reasoning can be reduced to prompts and dashboards by people who never understood the reasoning process to begin with. It's gonna continue to be a wild ride for a bit.

Investigation Scenario 🔎 You believe a Linux server was used ...

2026-04-21T17:07:28Z

Investigation Scenario 🔎

You believe a Linux server was used as a jump box to pivot into another network segment, but the network traffic would not have crossed a sensor boundary for logging.

What evidence do you look for to prove the belief?

#InvestigationPath #DFIR #SOC

"This has an em dash—it must be AI!" 😩 GenAI uses em ...

2025-11-12T14:44:26Z

"This has an em dash—it must be AI!" 😩

GenAI uses em dashes, in part, because it was trained on material written by authors like me. Without our consent, might I add.

The machines can pry my em dashes from my cold, dead hands.

We have a space-themed children's book coming out next month. ...

2025-04-03T13:32:51Z

We have a space-themed children's book coming out next month.

The new tariffs announced yesterday mean we'll have to charge 54% more for it bc we'll have to pay that tariff tax.

Get it printed in the US, you say? We'd have to charge 130% more for it bc of the production cost.

It was a beautiful day to get out and vote! ...

2024-10-30T00:02:14Z

It was a beautiful day to get out and vote!