<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Investigation Scenario 🔎]]></title><description><![CDATA[<p>Investigation Scenario <img src="https://board.circlewithadot.net/assets/plugins/nodebb-plugin-emoji/emoji/android/1f50e.png?v=28325c671da" class="not-responsive emoji emoji-android emoji--mag_right" style="height:23px;width:auto;vertical-align:middle" title="🔎" alt="🔎" /></p><p>A host on your network executed the command “netsh wlan show profile” for the first time.</p><p>What do you look for to investigate whether an incident occurred?</p><p><a href="https://infosec.exchange/tags/InvestigationPath" rel="tag">#<span>InvestigationPath</span></a> <a href="https://infosec.exchange/tags/DFIR" rel="tag">#<span>DFIR</span></a> <a href="https://infosec.exchange/tags/SOC" rel="tag">#<span>SOC</span></a></p>]]></description><link>https://board.circlewithadot.net/topic/5aa8f525-146a-411a-a511-a972d7cf65ae/investigation-scenario</link><generator>RSS for Node</generator><lastBuildDate>Thu, 09 Apr 2026 09:40:03 GMT</lastBuildDate><atom:link href="https://board.circlewithadot.net/topic/5aa8f525-146a-411a-a511-a972d7cf65ae.rss" rel="self" type="application/rss+xml"/><pubDate>Tue, 10 Mar 2026 14:00:28 GMT</pubDate><ttl>60</ttl><item><title><![CDATA[Reply to Investigation Scenario 🔎 on Tue, 10 Mar 2026 14:00:28 GMT]]></title><description><![CDATA[<p>I post these scenarios every Tuesday! We're up to 135 of them so far! If you enjoy them, you'll probably like my Investigation Theory class where I work with folks directly on improving their investigative skills leverage principles from cognitive science: <a href="https://www.networkdefense.co/courses/" rel="nofollow noopener"><span>https://www.</span><span>networkdefense.co/courses/</span><span></span></a></p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/chrissanders88/statuses/116205238935057230</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/chrissanders88/statuses/116205238935057230</guid><dc:creator><![CDATA[chrissanders88@infosec.exchange]]></dc:creator><pubDate>Tue, 10 Mar 2026 14:00:28 GMT</pubDate></item></channel></rss>