One of the most common questions analysts ask me -- what do I do when I get stuck in an investigation? This happens to everyone, especially when you're inexperienced. Let's talk about that... 1/
First of all, how do you know when you're stuck? You can usually tell when you start:
- Looking at the same data over and over
- Wading through data aimlessly
- Become more easily distracted by other things
These things all lead to various forms of anxiety or doubt. Not fun. 2/
- Looking at the same data over and over
- Wading through data aimlessly
- Become more easily distracted by other things
These things all lead to various forms of anxiety or doubt. Not fun. 2/
I teach 5 primary strategies for dealing with being stuck in Investigation Theory.
First, draw our your timeline. The timeline is at the heart of investigative findings. By writing it out, you can more easily spot gaps to focus your questioning. 3/
First, draw our your timeline. The timeline is at the heart of investigative findings. By writing it out, you can more easily spot gaps to focus your questioning. 3/
Next, leverage divergent and convergent thought. Make a list every investigative question you could ask in your situation, then pick the best one from the list and work through them all until no questions are left.
Learn more about C/D thinking here: chrissanders.org/2019/10/creati…
4/
Learn more about C/D thinking here: chrissanders.org/2019/10/creati…
4/
After that, map out the data you've collected so far and compare it to your available data sources. What other data sources can you plug your data into? Perform those searches and see what you find. This is more exploratory, but that's the way this process trends eventually. 5/
If you're still stuck, focus on common areas of interest for the hosts you're dealing with.
Things like program executions, autoruns, downloaded files, user account modifications, etc. Places where you're most likely to find other anomalies. 6/
Things like program executions, autoruns, downloaded files, user account modifications, etc. Places where you're most likely to find other anomalies. 6/
Finally, if all else fails, get some separation from the situation. Take a walk, go to lunch, or even better... sleep. Behold the power of neural optimization. This is the most underrated strategy and the simplest. 7/
If you're still nowhere, then it may be time to move on. Consider turning up some logging or setting additional alerts to follow up on the affected host later if you're still suspicious. 8/
Those are broad strokes -- I teach these strategies and their underlying concepts in my Investigation Theory class. The next online session starts in May, but I also teach it on site (min 12 folks).
networkdefense.co/courses/invest…
9/
networkdefense.co/courses/invest…
9/
Getting stuck is common -- it happens to everyone at some point and still happens sometimes to experienced analysts. It sucks, but there are strategies to overcome it that are incredibly effective. Once you understand how you think, you can regulate it. You're in control!
10/10
10/10
