PARIS — (CNN) The ringleader of the Paris attacks last month appears to have directed the three terrorists inside the Bataclan theater by phone from a few blocks away, according to a French terrorism expert. And, a witness has told French investigators that they saw Abdelhamid Abaaoud standing in a doorway yelling into his phone for about an hour.

That night, the witness had several times gone to a car parked nearby, and Abaaoud had been there every time. They described the man as very agitated. When the witness later walked past him, they were able to see his face. Abaaoud’s head was shaved and he was wearing layers of loose clothing, but when photographs were later published in the media the witness immediately recognized him and alerted the authorities.

The witness account was disclosed by French terrorism analyst Jean Charles Brisard in the latest edition of the Combating Terrorism Center’s journal Sentinel.

Brisard writes that “the presence of Abaaoud in the immediate vicinity of the attacks provides an indication of his degree of implication in the supervision and control of the plot, and suggests he was giving direct orders and instructions to his team inside the Bataclan.”

Earlier in the evening, according to the Paris prosecutor Abaaoud’s phone records show he was communicating with Bilal Hadfi, one of the stadium bombers, right until the moment the three suicide bombers at the Stade de France started blowing themselves up.

Earlier that same evening — November 13 — Abaaoud was detected on surveillance cameras at a metro station just a few hundred yards away from where one of the terrorists’ cars had been abandoned. He then appears to have returned to the scene of the attacks, according to the Paris prosecutor, after analysis of his cell phone signal.

The prosecutor, Francois Molins, told a news conference on November 24 that Abaaoud’s phone was geo-located in the vicinity of the attacks between 10:28pm and 12:28am that night, inlcuding in proximity to the Bataclan before the attack was over.

Abaaoud had previously appeared in videos produced by ISIS, and the group claimed responsibility for the Paris attacks the day after they occurred.

He was killed five days later when police raided an apartment in the Paris district of St. Denis, along with a female cousin and a man who has not been identified. According to French investigators, Abaaoud was planning another wave of attacks in the business district of Paris known as La Defense and had also talked about attacks on public transportation, schools and “Jewish targets.”

The investigation into the Paris attacks has uncovered that at least eight of those involved in the plot were French nationals who had been to Syria — a worrying sign for European intelligence services. Several had been based in Molenbeek — a suburb of Brussels that has been the base for previous jihadist plots. Abaaoud himself was Belgian and had grown up in the Molenbeek area.

According to Brisard, most of those involved in the plot re-entered Europe in August.

Salah Abdeslam, who drove three of the suicide bombers to the Stade de France, is still being sought. There has been no sighting of him since hours after the attacks, when he was stopped on the Belgium border, but let go because investigators had not yet connected him to the attacks.

According to Brisard, Abdeslam and Abaaoud are believed to have planned and co-ordinated the attacks. Abdeslam had made several trips between the French and Belgian capitals in September and October, and he had also traveled to Italy, Hungary and Austria.

Brisard reports that investigators have established that the weapons used in the attacks were bought online or through criminal networks, Brisard says.

The Paris attacks have focused attention on the substantial French contingent within ISIS. The statement claiming responsibility was read by one of them — Fabien Clain — who is now thought to be a senior figure within ISIS according to Brisard. The terrorism expert writes that Clain’s name “had been associated with a 2009 plot against the Bataclan” theater.

Clain was also a friend of the family of Mohammed Merah who carried out a series of gun attacks in the Toulouse area in 2012.

Other individuals of interest to French investigators are Salim Benghalem and Boubaker el-Hakim, who are both believed to be senior ISIS operatives based in Syria.

There are more French citizens and residents among foreign fighters in Syria and Iraq than of any other European nation according to Brisard.

“More than 2,000 French citizens and residents are involved in Syrian and Iraqi jihadi networks. Among them, 600 are believed to be fighting alongside terrorist organizations abroad and 250 are believed to have returned,” he says.

Abaaoud was focused on using this contingent — and Belgian jihadists who had returned — to hit European targets. A plot similar to the Paris attacks was foiled in January in Verviers, in eastern Belgium, when authorities raided a safe house, setting off a gun-fight in which two alleged terrorists were killed. Abaaoud had been in contact with that group by cell phone from Greece, according to investigators.

In August a returning French foreign fighter told investigators he had attended a training camp for a week in Raqqa, ISIS’ headquarters in Syria, before being told by Abaaoud to launch an attack. The chosen target was a concert hall. “Abaaoud had provided him a USB stick containing encryption software and 2,000 euros,” writes Brisard.

The accumulation of ISIS-directed European plots this year is alarming for European governments, Brisard says. He writes that the Paris attacks “demonstrated major failures in European border control policy and the exchange of information between European Union member states.”

“The fact that most of the perpetrators and facilitators of the attacks were able to travel and slip undetected into the heart of Europe, and then travel back and forth between Belgium and France to prepare the attacks raises significant concerns” about European security agencies’ abilities to detect plots, Brisard adds.

The-CNN-Wire ™ & © 2015 Cable News Network, Inc., a Time Warner Company. All rights reserved. (Photo: CNN)