Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange
Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/
infosec.exchange
Investigation Scenario 🔎
Alert: Microsoft Defender for Endpoint: Behavior:Win32/SuspClickFix.F detected on a Windows 11 workstation.
No additional context is provided. What artifacts would you examine first to determine whether the user executed the ClickFix command?
To go further, what would you look for to determine whether the alert represents the beginning of an ACR Stealer intrusion?
#InvestigationPath #DFIR #SOC