In search of cultivating a more cognitively diverse brain, research provides strategies... "... [Viewing] abstract art elicited greater interindividual variability in activity within higher-order, associative brain areas" compared to representational art. 🎨🧠

I just published my annual list of the best books I read all year... chrissanders.org/2025/12/my-... What are some of your favorite books you encountered in 2025?

What's the best interview question you've been asked (or used) for a SOC Analyst/Forensic/Hunting/Threat Intel role?

"Those who ultimately come to occupy the most influential positions exhibit early and accurate representations of their network’s general, abstract structure (i.e., who belongs to which communities and cliques)."

Investigation Scenario 🔎 While reviewing web logs on a Linux Apache server, you discover inbound requests for PHP pages. However, the server is not reported to host PHP content. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC

Unsurprisingly, LLMs can boost creativity, BUT... primarily for those who employ metacognitive strategies along with their use. We're talking about actively reflecting on how they're using it and adapting it to complement existing ways of thinking. 🧠

If you have influence in our industry, people will eventually try to pay you to endorse their product without disclosing that you were compensated. Ask yourself... do you think that you're the first and only person they've approached?

It's harder to sustain attention the longer a task takes. That's pretty well established, but importantly and often overlooked is that this effect remains *even if the task is engaging*. Even if we think we're actively engaged, the mind wanders more with time.

Lest we forget observer bias -- In part of this recent experiment, managers were more likely to rate employees they monitored more frequently as less productive, even though their productivity was on par with that of other employees.

Incredibly meaningful lessons learned from a student in my Practical Threat Hunting course... The research doesn't distract from the work; it *is the work*. Bonus? You get to carry that attack knowledge to future hunts and investigations.

Investigation Scenario 🔎 A Windows system executed dsa.msc for the first time. What do you look for to investigate whether an incident occurred AND its scope? #InvestigationPath #DFIR #SOC

My friends, the time has come. This holiday season, I'm giving away a golden ticket that grants free entry into ALL my training courses, a year's worth of chocolate, and tons of other amazing prizes.

And now, a very important message... youtu.be/NnINyr9PUBw #GoldenTicket

FINAL DAY!! Every one of my courses is 25% off until midnight 🚀✨ It's the only sitewide sale we do all year, and the cheapest you'll see these courses. This discount is for all y'all, so use the code ALLYALL at checkout. View my courses here: networkdefense.io/

Investigation Scenario 🔎 You've found a new entry in ShimCache on Windows 10: C:\Users\Public\svchost32.exe with a last modified timestamp predating system boot. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC

Every one of my courses is 25% off today 🚀✨ It's the only sitewide sale we do all year, and the cheapest you'll see these courses. This discount is for all y'all, so use the code ALLYALL at checkout.

A world of pure imagination... ...coming Wednesday...

Congrats to Adam! Sunday's winner of three free months in my Analyst Skills Vault! networkdefense.co/skillsvault Each day of the sale, one person who uses this discount code will be randomly selected to win! Two more chances...

Congrats to Daniel! Saturday's winner of three free months in my Analyst Skills Vault! networkdefense.co/skillsvault Each day of the sale, one person who uses this discount code will be randomly selected to win!

Congrats to Casimiro! Friday's winner of three free months in my Analyst Skills Vault! networkdefense.co/skillsvault Each day of the sale, one person who uses this discount code will be randomly selected to win!

LIFTOFF! All my courses on networkdefense.io are 25% off until Tuesday, 12/2, at midnight ET 🚀 This is the only sitewide sale we do all year, and the cheapest you'll see these courses. This event is for all y'all, so to get the discount, use code ALLYALL at checkout.

Meanwhile, my Milo and the Midnight Meteorite book is 20% off for Black Friday, starting now! That includes signed copies and copies that come with a small meteorite in a custom Milo display case. A great gift to get your kids interested in space and science!

AND course sale goes live Friday morning. Discount code will be posted here and sent to my mailing list subscribers 👀

What sort of science or tech classes and clubs do you wish existed when you were in school? 🤔

Sysmon will soon be (kinda) native to Windows 11! Great! techcommunity.microsoft.com/blog/window... Now, how about we take this seriously and enable it by default?

Investigation Scenario 🔎 A user reports their Chrome homepage keeps changing to cryptocoin websites after setting a new wallpaper they downloaded from a Reddit post. What do you look for to confirm a malware infection and investigate its impact on the system? #InvestigationPath #DFIR #SOC

You've been in your job for three years... did you actually gain three years of experience… or did you gain the same year of experience three times over?

"This has an em dash—it must be AI!" 😩 GenAI uses em dashes, in part, because it was trained on material written by authors like me. Without our consent, might I add. The machines can pry my em dashes from my cold, dead hands.

Investigation Scenario 🔎 A public-facing web server is no longer accessible from the browser. Your director believes a denial of service attack may be the cause. What do you look for to investigate the cause of the availability issue? #InvestigationPath #DFIR #SOC

"Me, a wizard? Until a week ago, I was an astronomer, contentedly designing telescope optics."

I'm putting the finishing touches on our annual Golden Ticket fundraiser for the Rural Technology Fund, and we really need a few more corporate sponsors. If you can help, send me a DM. Lots of great benefits! Expect 300% more whimsy this year.

Investigation Scenario 🔎 A helpdesk tech reports that after installing an update for a third-party remote management tool, outbound connections to 45.77.XX.XX:8080 from its service started appearing across multiple endpoints.

What are some instances where the acquisition of an effective security company by a large / publicly traded company actually made the acquired product or service better?

Why do investigative playbooks work? #SOC #DFIR 1. In any given investigation, analysts ask investigative questions that they answer with data (evidence) to determine what happened and if malicious activity occurred.

I've hidden 5 of my business cards around the @BSidesAugusta venue. Each one has a code written on it that's good for 50% off any one of my courses at networkdefense.io/. They're in plain sight so don't go looking above ceiling tiles or anything silly. Good luck :)

Good morning, Augusta. #SecurityOnionCon @BSidesAugusta

Investigation Scenario 🔎 While attending a conference, a user reports they were connected to a rogue access point for a couple of hours rather than the official conference wifi. What do you look for to investigate the impact of the incident? #InvestigationPath #DFIR #SOC

When an admin creates a new user account on a domain, what do you suspect is the average time between account creation and its first authentication? I don't know the answer, generally curious on others input.

A peek behind the scenes on some of the @RuralTechFund space and tech outreach we do -- this time from my local library! youtube.com/shorts/yaZW...

A week from now, I'll be speaking at @securityonion con alongside my good friend @DefensiveDepth. We'll talk about human-centric investigation playbooks and how those manifest in Security Onion now. Hope to see you there in Augusta! securityonionsolutions.com/conference/

Investigation Scenario 🔎 Someone inside your network opened a file containing a honeytoken. The file is a spreadsheet on a web server that isn't linked anywhere publicly facing. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC

My photo submission for the 2026 Meteorite Calendar... three lunar stones from my collection, titled "Colors of the Moon". While we primarily think of the moon as a uniform shade, there's a lot more there than what initially meets the eye! #space #astronomy #science #geology #STEM

We've got students in our @RuralTechFund Infinite Sky cohort building high-altitude balloon experiments that will... ...create atmospheric and solar irradiance profiles ...collect temperature and pressure readings ...detect levels of UV and IR radiation in the upper atmosphere

Good analysts take broad investigative questions and unpack them into specific questions that are directly answerable from evidence. Let's say that you observed the download of a suspicious file, but it's no longer located on the file system.

Investigation Scenario 🔎 A Windows prefetch file named RUNDLL32.EXE-3A2B9C71[.]pf shows a referenced file at C:\Users\Public\update.dll, but the DLL is missing. You're unable to collect a memory dump and no EDR is available.

At @RuralTechFund, we require that schools/clubs/programs we financially support aren't academically exclusionary. That means they can't limit access to tech education to only students with high grades.

If you're a student who shows up at my office hours today, I expect you to come with your favorite song from the new Taylor album.

They're all bangers 🔥💯

Investigation Scenario 🔎 AV on a point of sale system flags a new startup entry named “PSLService.exe” in C:\Users\Public\Kiosk\. Festive fall plugin or cred stealer? Something else? What are your first few moves to investigate this finding? #InvestigationPath #DFIR #SOC

Periodic reminder that if you take my Investigation Theory course, you're working directly with me and I'm responding to your labs and exercises individually. That's something I prioritize above other things, and I make time for it every day.