Thread by @chrissanders88

Let's talk about some lessons gathered from how a student over the weekend quickly went from struggling on an investigation lab and...

"I'm stuck"

to finished and...

"I don’t know if you just Yoda’d the hell out of me or what"

1/x

This particular student emailed and said they were stuck and gave me some misc facts they had discovered. I responded and asked them to lay out a timeline of what they knew already so that we could work together to spot the gaps. 2/

The truth is that when this inquiry is taken seriously, it doesn't often result in us having to spot those gaps together at all because the student figures it out on their own. Why does this happen? Two main reasons... 3/

First, when forced to revisit an investigation and build an actual timeline, analysts notice gaps to pursue or things that they missed. 4/

I can't stress how important this skill is. I've seen it over and over again in my empirical research of highly skilled analysts. Experts constantly revisit what they've found and conceptualize it all on a timeline. 5/

Analysts with lots of working memory capacity can sometimes do this in their heads, while those with lower WM capacity are more likely to write it down. The complexity of the attack also plays a factor here as well. 6/

Every new significant piece of information an analyst discovers means processing its meaning... on its own, in relation to the entities and relationships around it, and in relationship to the broader attack timeline. 7/

Second, when jumping into evidence without an explicit purpose, analysts are more likely to miss things. In this case, the analyst had looked at authentication logs many times but skipped right over the service account being used for lateral movement from an infected host. 8/

Investigations don't always reveal things in the order they happened. When you revisit things in a timeline, it's easier to connect the meaning between events. You're more likely to understand the significance of an evidence source and what is potentially there. 9/

For this analyst, they had mostly stumbled into auth logs in the first place. When they revisited the attack timeline while knowing where they were in it, the lateral movement stood out more. 10/

So here, it's all about the lens through which you view evidentiary data. As your lens shifts, viewing the same data can reveal new things. It's how experts operate and how inexperienced analysts learn. 11/

So... Jedi mind trick? No. But, when you stop to think back through the timeline of events, gaps and connections are more easily revealed. 12/12