Elektrine
EN
Log in Register
Paige Chat Timeline Communities Gallery Videos Email DNS VPN Uptime Kairo
Back to Timeline
Remote

Chris Sanders 🔎 🧠

@chrissanders88@infosec.exchange
  • Open on infosec.exchange

Security Analyst, Author, and Instructor, Ed.D.

Studying the intersection of security investigation doctrine, cognitive psychology, and education.

Founder of Applied Network Defense and Rural Tech Fund

Books:
🍯 Intrusion Detection Honeypots
🦈 Practical Packet Analysis
🌐 Applied Network Security Monitoring

Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor.

A question well stated is a problem half-solved. #InvestigationTheory

https://chrissanders.org/links/

0 Followers
0 Following
15 Posts
Joined November 05, 2022
Blog:
https://chrissanders.org/
Training Courses:
http://networkdefense.co/courses/
Twitter:
https://twitter.com/chrissanders88
Books:
https://chrissanders.org/publications
More Links:
https://chrissanders.org/links/

Posts

Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Jul 23, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange
Replying to @chrissanders88@infosec.exchange
Specific technical expertise is valuable and should be compensated accordingly, but that isn’t the same thing as seniority. Judgment and specialization don't always correlate. Many companies get that wrong in their hiring/promotions, and many individuals get that wrong in planning their career development.
0
0
0
0
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Jul 23, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange
This may be a hot take, but a senior title should recognize someone who consistently applies broad experience, sound judgment, and nuanced perspective across a wide range of situations... not just someone who possesses a rare or in-demand technical skill at the time.
0
1
0
0
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Jul 21, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange
Investigation Scenario 🔎 Alert: Microsoft Defender for Endpoint: Behavior:Win32/SuspClickFix.F detected on a Windows 11 workstation. No additional context is provided. What artifacts would you examine first to determine whether the user executed the ClickFix command? To go further, what would you look for to determine whether the alert represents the beginning of an ACR Stealer intrusion? #InvestigationPath #DFIR #SOC
0
1
0
0
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Jul 16, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange
Replying to @deirdrebeth@mas.to
@deirdrebeth@mas.to No, it's new. UPS does a 1lb minimum, but USPS has previously done by-the-ounce pricing.
0
0
0
0
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Jul 16, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange
Call it what you like, but this is a rural tax from USPS. People in rural communities already have fewer local shopping options and rely more heavily on mail delivery. Making lightweight packages more expensive to send there seems antithetical to the idea of this public service.
0
3
0
0
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Jul 15, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange
Replying to @chrissanders88@infosec.exchange
Source: https://papers.ssrn.com/sol3/Delivery.cfm?abstractid=5864662
0
0
0
0
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Jul 15, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange
In a recent study, those who actively planned, monitored, and critiqued their thinking (aka higher metacognitive skills) used LLMs more effectively and produced more creative work. Thinking about thinking has never mattered more.
0
1
0
0
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Jul 14, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange
Investigation Scenario 🔎 A Windows 11 workstation’s Microsoft-Windows-TaskScheduler/Operational log contains Event ID 106, indicating a new scheduled task named "OneDrive Update Service" was registered at 5:45 PM local time. The user insists they were away from the computer when this happened. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC
0
2
0
0
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Jul 09, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange
"Show your work." When I was in school, kids would get mad when teachers would ask them that. "What does it matter so long as I get the right answer?" Showing your work has always been the essential lesson, because eventually, someone will tell you that you’re wrong. If you can’t explain how you reached your conclusion, you can’t defend it. Your value isn’t just producing an answer... It’s being able to explain, defend, and adapt your reasoning. It's never been more valuable than now.
104
13
65
3
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Jul 07, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange
Replying to @chrissanders88@infosec.exchange
This is also our 150th (!) investigation scenario! I'll pick a favorite response at the end of the week and give you a free class at https://networkdefense.io
0
0
0
0
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Jul 07, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange
Replying to @chrissanders88@infosec.exchange
If you're not familiar with these files or Linux persistence, this scenario is a good opportunity to practice your research skills. Good analysts take novelty cues like this and leverage them to build their tradecraft knowledge.
0
1
0
0
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Jul 07, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange
Investigation Scenario 🔎 You’ve found ~/.config/systemd/user/dbus-update.service enabled for a user account on an Ubuntu system. The service executes ~/.local/bin/dbus-update, an ELF binary that isn’t owned by any installed package. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC
0
1
0
0
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Apr 20, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange

RE: @dougburks@infosec.exchange

Doug built ANOTHER useful thing! I had a chance to play around with OhMyPCAP pre-release... super handy and worth having in your toolbox!

infosec.exchange

Doug Burks: "Introducing a new PCAP tool - OhMyPCAP OhMyPCAP …" - Infosec Exchange

4
0
3
0
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Apr 17, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange

When you hear the word "identity" in cybersecurity, what does that mean to you? How do you define it?

1
0
2
0
Open post
chrissanders88
Chris Sanders 🔎 🧠 @chrissanders88@infosec.exchange · Feb 12, 2026
Chris Sanders 🔎 🧠
@chrissanders88@infosec.exchange

Security Analyst, Author, and Instructor, Ed.D. Studying the intersection of security investigation doctrine, cognitive psychology, and education. Founder of Applied Network Defense and Rural Tech Fund Books: 🍯 Intrusion Detection Honeypots 🦈 Practical Packet Analysis 🌐 Applied Network Security Monitoring Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor. A question well stated is a problem half-solved. #InvestigationTheory https://chrissanders.org/links/

infosec.exchange
Boosted by Greg Bell @ferrix@mastodon.online
"...the propensity for prosocial behavior may be reduced in states of cognitive fatigue resulting from the extended exertion of self-control." similar to "sleep-like activity" Prolonged cognitive fatigue ➡️ frontal cortex changes ➡️ more aggressive and uncooperative
2
0
5
0

Remote instance

infosec.exchange
Open on original server

Media

313k7r1n3
Elektrine

Tor hidden service

elekhj7afj4qnrr4yd3bkzslsyo5jgfxw3orgjkhlcxifueodybyiiad.onion

Platform

  • Email
  • Chat
  • Timeline
  • Communities
  • VPN
  • DNS

Company

  • About
  • Contact
  • FAQ

Legal

  • Terms of Service
  • Privacy Policy
  • Warrant Canary
  • Lite (no JS)
  • VPN Policy
  • Source code

Support

  • support@elektrine.com
  • Report Security Issue
Mail client setup IMAP mail.elektrine.com:993 POP3 mail.elektrine.com:995 SMTP mail.elektrine.com:465
© 2026 Elektrine. All rights reserved. Server: 20:31:39 UTC