Tweet

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @chrissanders88

Chris Sanders 🍯

@chrissanders88

4 Jan

I think blue team work poses a greater number of challenges than red team work (there's just so much attack surface). However, I think writing a red team report is inherently harder than writing forensic reports. 1/

In a forensic report, a story already happened and you have to tell it. It takes practice and skill to do that well, but there is less of a creative element. The analyst's burden to elicit an emotional response is smaller. 2/

The events in the report themselves have evoked emotion... pain, sadness, etc. It's not as hard to get folks to take action because they've already felt these things. 3/

Read 13 tweets

Chris Sanders 🍯

@chrissanders88

28 Oct 20

One of the things I do in my Investigation Theory course, for those willing, is work with students individually to help them learn to ask better investigative questions. For example, one student started with this Suricata rule:

1/

The task here is to start by asking a couple of investigative questions, assuming you have access to any evidence you might want. This student posed these two:

1. How long as this machine been infected?
2. How many beacons has the machine sent?

2/

In this case, the student is making some assumptions that the machine is already infected, but we don’t really know that for certain yet. The first goal should be proving or disproving the infection.

How do you do that? 3/

Read 17 tweets

Chris Sanders 🍯

@chrissanders88

27 Oct 20

https://twitter.com/IISResetMe/status/1321123690399076354

This was something I left intentionally vague in the poll to see how people interpreted it. Namely, some interpreted as competitive within your team, others as competitive in relation to a goal/adversary. Reveals some predispositions and bias, perhaps?

https://twitter.com/IISResetMe/status/1321123690399076354

Consider the example of a wide receiver. They are internally competitive with their teammates because there are only so many spots on the team and passes to catch. At the same time, they are externally competitive towards the other team because they want to win the game.

In security, I observe that internal competitiveness is often over exhibited relative to the value and external competitiveness under exhibited relative to the value.

Read 11 tweets

Chris Sanders 🍯

@chrissanders88

5 Sep 20

I mentioned that the idea for Intrusion Detection Honeypots #idhbook was floating around in my head for a long time. Something I didn't mention in the book, is that it was my time as a pen tester many years back that crystaized some key parts of the concept for me. 🍯 1/

As the attacker, it's all about iterative discovery. You access something, look around, and leverage your access to move on to the next thing. You do this until you reach a goal, whatever it may be. 2/

@inguardians

Good attackers exhibit some common traits -- seeking to decrease ambiguity, adaptability, and curiosity are big ones. You have to take what the network gives you and manipulate it. I really learned the value of these things in the offensive context at @inguardians. 3/

Read 12 tweets

Chris Sanders 🍯

@chrissanders88

25 Jun 20

Let's talk about the differences between novices and experts. But, instead of cyber security, we'll use airport baggage screeners as an example. These are the folks who use the scanner screens to find forbidden items in luggage 1/

We all expect that experts are faster than novices. That's often correct, but WHY? 2/

Experts go through a few steps when looking at a bag image. First, they perceive the whole image quickly, looking for something to draw their attention. Maybe a dark spot or an unknown pattern. This holistic analysis is nearly automatic. 3/

Read 16 tweets

Chris Sanders 🍯

@chrissanders88

16 Jun 20

The most frequent mistake inexperienced analysts make when asking investigative questions is not being specific enough. For example, "Is this external IP bad?". That's a fine question, but it's not answerable without asking more questions. 1/

A deeper question might be, "Does this IP appear on any reputation lists?" or "Is it found in malware sandbox executions in public repos?" or "Have we encountered this IP in any other investigations?" . 2/

Another example, "Is this system infected?". We definitely want to know that, but it's more specific questions that get us there. 3/

Read 9 tweets

Share this page!

Chris Sanders 🍯

Try unrolling a thread yourself!

More from @chrissanders88

Chris Sanders 🍯

Chris Sanders 🍯

Chris Sanders 🍯

Chris Sanders 🍯

Chris Sanders 🍯

Chris Sanders 🍯

Did Thread Reader help you today?

Like this author's thread?