Chris Sanders 🔎 🧠

Security Analyst, Author, and Instructor, Ed.D.

Studying the intersection of security investigation doctrine, cognitive psychology, and education.

Founder of Applied Network Defense and Rural Tech Fund

Books:
🍯 Intrusion Detection Honeypots
🦈 Practical Packet Analysis
🌐 Applied Network Security Monitoring

Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor.

A question well stated is a problem half-solved. #InvestigationTheory

https://chrissanders.org/links/

Blog: https://chrissanders.org/
Training Courses: http://networkdefense.co/courses/
Twitter: https://twitter.com/chrissanders88
Books: https://chrissanders.org/publications
More Links: https://chrissanders.org/links/

Last Notes

2026-07-21 14:08:16 UTC

Investigation Scenario 🔎
Alert: Microsoft Defender for Endpoint: Behavior:Win32/SuspClickFix.F detected on a Windows 11 workstation.
No additional context is provided. What artifacts would you examine first to determine whether the user executed the ClickFix command?
To go further, what would you look for to determine whether the alert represents the beginning of an ACR Stealer intrusion?
#InvestigationPath #DFIR #SOC

2026-07-09 15:15:25 UTC

"Show your work."
When I was in school, kids would get mad when teachers would ask them that. "What does it matter so long as I get the right answer?"
Showing your work has always been the essential lesson, because eventually, someone will tell you that you’re wrong. If you can’t explain how you reached your conclusion, you can’t defend it.
Your value isn’t just producing an answer... It’s being able to explain, defend, and adapt your reasoning.
It's never been more valuable than now.

2026-06-19 13:38:54 UTC

- reply

I promise this isn't focused on any one specific company; you can call it my naive idealism if nothing else.

2026-06-19 13:38:54 UTC

With all the recent M&A activity and more certainly to come, I keep arriving back at the same question... are people going to be safer?

2026-06-11 14:14:57 UTC

I use LLMs for a variety of tasks every day and frequently benchmark domain-specific tasks across different models for my research. So, where am I on LLM use for security analysis and investigation work? In short summary:

2026-05-14 14:47:56 UTC

Many of the same people who don't understand how analysts think are trying to tell AI how to do it and sell you the results. You shouldn't trust any of them.
I’m not anti-AI. It makes me a better analyst. I’m anti pretending that complex investigative reasoning can be reduced to prompts and dashboards by people who never understood the reasoning process to begin with. It's gonna continue to be a wild ride for a bit.

2026-04-21 17:07:28 UTC

Investigation Scenario 🔎
You believe a Linux server was used as a jump box to pivot into another network segment, but the network traffic would not have crossed a sensor boundary for logging.
What evidence do you look for to prove the belief?
#InvestigationPath #DFIR #SOC

2025-11-12 14:44:26 UTC

"This has an em dash—it must be AI!" 😩
GenAI uses em dashes, in part, because it was trained on material written by authors like me. Without our consent, might I add.
The machines can pry my em dashes from my cold, dead hands.

2025-04-03 13:32:51 UTC

We have a space-themed children's book coming out next month.
The new tariffs announced yesterday mean we'll have to charge 54% more for it bc we'll have to pay that tariff tax.
Get it printed in the US, you say? We'd have to charge 130% more for it bc of the production cost.

2024-10-30 00:02:14 UTC

It was a beautiful day to get out and vote!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/393/436/657/673/113/original/52655faeef9bb01d.png