TLP - The Digital Forensics podcast

Player FM - Internet Radio Done Right

تمت الإضافة منذ forty-eight أسبوع

المحتوى المقدم من Clint Marsden. يتم تحميل جميع محتويات البودكاست بما في ذلك الحلقات والرسومات وأوصاف البودكاست وتقديمها مباشرة بواسطة Clint Marsden أو شريك منصة البودكاست الخاص بهم. إذا كنت تعتقد أن شخصًا ما يستخدم عملك المحمي بحقوق الطبع والنشر دون إذنك، فيمكنك اتباع العملية الموضحة هنا https://ar.player.fm/legal.

The Agile Brand with Greg Kihlström®

1
#669: It's already time to start planning for the holiday shopping season with Carey Cockrum, Cella by Randstad Digital 28:52

منذ 10 أيام28:52

التشغيل لاحقا

قوائم

إعجاب

احب

28:52

Retailers are facing a rapidly evolving landscape where consumer expectations, AI advancements, and social media platforms like TikTok are redefining engagement. It feels like the holiday shopping season just ended, but when do retailers start planning for the next one, and some retailers already behind the curve for this season? Joining us today is Carey Cockrum, Director of Consulting at Cella by Randstad Digital, where she helps major brands and marketing teams optimize their strategies with data-driven insights, AI-powered content creation, and cutting-edge retail marketing trends. With the holidays just around the corner, she’s here to share what’s next for retail marketing, campaign optimization, and how brands can stay ahead in a hyper-competitive space. ABOUT CAREY COCKRUM Carey has been a part of the Creative Agency space for nearly 30 years. She has served as Designer, Creative Director, Creative Operations Lead and Agency Lead in both internal and external agencies (big and small). Carey has worked directly with C-suite stakeholders to understand organizational strategies that inform effective creative solutions. She is a bit of a data nerd and loves demonstrating results. Brands she’s supported include Fruit of the Loom, Wendy’s and Humana. In her free time, she enjoys going back to her creative roots through painting and drawing. She also spends her time improving upon the house she lives in today in Southern, MI - inside and out. RESOURCES Catch the future of e-commerce at eTail Boston, August 11-14, 2025. Register now: https://bit.ly/etailboston and use code PARTNER20 for 20% off for retailers and brands Don't Miss MAICON 2025, October 14-16 in Cleveland - the event bringing together the brights minds and leading voices in AI. Use Code AGILE150 for $150 off registration. Go here to register: https://bit.ly/agile150 Connect with Greg on LinkedIn: https://www.linkedin.com/in/gregkihlstrom Don't miss a thing: get the latest episodes, sign up for our newsletter and more: https://www.theagilebrand.show Check out The Agile Brand Guide website with articles, insights, and Martechipedia, the wiki for marketing technology: https://www.agilebrandguide.com The Agile Brand podcast is brought to you by TEKsystems. Learn more here: https://www.teksystems.com/versionnextnow The Agile Brand is produced by Missing Link—a Latina-owned strategy-driven, creatively fueled production co-op. From ideation to creation, they craft human connections through intelligent, engaging and informative content. https://www.missinglink.company…

TLP - The Digital Forensics Podcast

منزل السلاسل•Feed

Get involved in the exciting world of Digital Forensics and Incident Response with: Traffic Light Protocol. The Digital Forensics Podcast.
In each episode, we sit down with seasoned DFIR professionals, the blueteamers who work around the clock to investigate cyber intrusions. From data breaches to cyberattacks, they share firsthand accounts of some of the most intense investigations they've ever tackled, how they deal with burnout and the added pressure of cat and mouse while they learn about new attack chains.

19 حلقات

#Tech #Clint Marsden #DFIR #Incident Response #Forensic #Cyber #Windows #Hacking #Blue Teaming #Red Team #Auscert

TLP - The Digital Forensics Podcast

updated منذ عام واحد

منزل السلاسل•Feed

19 حلقات

#Tech #Clint Marsden #DFIR #Incident Response #Forensic #Cyber #Windows #Hacking #Blue Teaming #Red Team #Auscert

كل الحلقات

1
Audiobook - Mastering Sysmon. Deploying, Configuring, and Tuning in 10 easy steps 43:16

منذ 10 weeks43:16

43:16

Send us a text This episode features the complete narration of my ebook: Mastering Sysmon – Deploying, Configuring, and Tuning in 10 Easy Steps , providing a step-by-step guide to getting Sysmon up and running for better threat detection and incident response . If you’re in security operations, digital forensics, or incident response , this episode will help you: Deploy Sysmon efficiently. Tune Sysmon logs for maximum insight while reducing noise. Use Sysmon for investigations —from process creation tracking to network monitoring. Understand real-world use cases of how Sysmon can catch adversaries in action. Key Topics Covered: Why Sysmon Matters – A deep dive into how Sysmon enhances Windows logging. Common Mistakes & How to Avoid Them – Logging misconfigurations, tuning issues, and evidence handling best practices. Step-by-Step Deployment Guide – From downloading Sysmon to configuring it for lean detections. Tuning for Performance & Relevance – How to tweak Sysmon settings to avoid excessive log volume. Investigating Security Events – Key Sysmon event IDs that provide forensic gold. Real-World Use Cases – Examples of how Sysmon has caught attackers in action. Sysmon Bypass Techniques – How adversaries evade detection and how to stay ahead. Resources Mentioned: Sysmon Download – Microsoft Sysinternals Sysmon Configuration Files – Olaf Hartong’s Sysmon-Modular MITRE ATT&CK Framework – MITRE ATT&CK ACSC Sysmon Config Guide – ACSC GitHub Key Takeaways: Sysmon provides deep system visibility – if tuned correctly. Tuning is essential – Avoid log overload while keeping useful data. Use a structured deployment process – From baselining performance to verifying logs. Sysmon alone isn’t enough – It works best when combined with other detection tools. Be aware of bypass techniques – Attackers can disable Sysmon, so defense in depth is key.…

1
Episode 17 - Building a CTF 28:07

منذ 10 weeks28:07

28:07

Send us a text So You Want to Build Your Own DFIR CTF? Ever wanted to build your own Digital Forensics and Incident Response (DFIR) Capture the Flag (CTF) challenge but weren’t sure where to start? In this episode of Traffic Light Protocol , we share the how-to of CTF builders, making it easy for anyone—no pentesting skills required! Today's episode includes: Choosing Your CTF Theme – Using MITRE ATT&CK and APT tracking to craft a realistic attack scenario. Setting Up the Lab – Spinning up a Windows VM , configuring Sysmon , and enabling forensic logging. Running the Attack Simulations – Using Atomic Red Team to generate forensic artifacts. Testing & Troubleshooting – Making sure your tests actually work before unleashing them on your team. Building an Engaging Story – Crafting a compelling incident narrative that challenges analysts to think like investigators. Resources mentioned in the podcast: https://drive.google.com/drive/folders/1vF3y-OlsowjX9LUOi7ywDy8VgcfhWcUX?usp=sharing…

1
Episode 16 - Mastering the Basics: Key Strategies for Cyber Investigations 30:43

منذ 10 weeks30:43

30:43

Send us a text Kicking off 2025, we're getting back to basics with something every cyber investigator needs to master—starting an investigation the right way. Too often, investigations get derailed because the right questions weren’t asked at the outset, evidence wasn’t properly handled, or reporting lacked clarity. In this episode, we cover how to build an investigation plan that keeps you on track, ensures consistency, and leads to better results. We talk about evidence volatility, log retention, structuring reports that make sense to non-technical stakeholders, and how to ask the right questions from the start.…

1
Episode 15 -Windows event log analysis with Hayabusa. The Sigma-based log analysis tool 23:20

منذ 29 weeks23:20

23:20

Send us a text Key Takeaways: Introduction to Hayabusa : Hayabusa is an open-source Windows Event Log Analysis Tool used for processing EVTX logs to detect suspicious activities in Windows environments. Critical Alerts Detection : The tool is capable of detecting a variety of suspicious activities, including WannaCry ransomware and unauthorized Active Directory replication. Efficient Incident Response : Hayabusa is ideal for incident response workflows, enabling teams to quickly triage and analyze Windows logs to detect potential breaches or malicious activity. Importance of Informational Alerts : Informational alerts can indicate early reconnaissance phases of attacks and should not be dismissed. Hypothesis-Driven Threat Hunting : Build a threat hunting hypothesis using MITRE ATT&CK or industry-specific threat intelligence to narrow the focus of the search. Integration with SIEM and TimeSketch : Hayabusa supports integration with security tools like SIEM and can export logs into TimeSketch for further analysis and visualization. Open-source and Free : Hayabusa is freely available to the cybersecurity community, making it an essential tool for threat detection without added cost.…

1
Episode 14 - AI and the future of log analysis, bug detection, forensics and AI ethical considerations with Jonathan Thompson 1:08:33

منذ 33 weeks1:08:33

1:08:33

Send us a text In this episode of Traffic Light Protocol , Clint Marsden is joined by Jonathan Thompson, a developer and AI enthusiast currently studying at Macquarie University. Together, they dive into how artificial intelligence (AI) is transforming the cybersecurity landscape and discuss Jon’s insights into AI’s potential applications in digital forensics, incident response, and everyday IT operations. The conversation touches on ethical considerations, potential job impacts, and how AI can be harnessed to streamline tasks like log analysis, bug detection, and threat identification. Daniel Kahneman - Thinking Fast and Slow https://amzn.to/47Cpfjo The pyramid of pain by David J Bianco: http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html…

1
Episode 13-ELK EDR and Sandboxing, Home grown CTF environments, DFIR Automation & Forensics in the cloud, with Jacob Wilson 54:55

منذ 37 weeks54:55

54:55

Send us a text Episode 13 is another giant episode with a focus on what its like be in the mud working on real life forensic investigations. Jacob and Clint talk about ELK EDR, using Sysmon. Sandbox Environments: Jacob discusses the creation of a sandbox environment using an ELK stack combined with Sysmon, enabling in-depth malware analysis by capturing and analyzing detailed system activity. Automation in Investigations: Jacob emphasizes the importance of automating repetitive tasks, such as business email compromise investigations, to streamline processes and improve efficiency. Pen Testing and Red Teaming: Jacob shares insights into the importance of understanding both offensive (red teaming) and defensive (blue teaming) techniques to better anticipate and mitigate threats. Practical Learning: Jacob advocates for hands-on experience in digital forensics, highlighting the limitations of theoretical knowledge and the value of real-world application. Resources Mentioned: ELK Stack : Used for creating a detailed sandbox environment for malware analysis. Learn more about ELK Stack here . Sysmon : Essential tool for capturing detailed logs on Windows systems. Explore Sysmon here . Axiom : A commercial digital forensics tool praised for its comprehensive and reliable results. More about Axiom here. Cellebrite : A tool used for mobile device forensics, particularly for logical acquisitions. Discover Cellebrite here. Splunk : Utilized for automating the investigation process by analyzing large datasets quickly. More on Splunk here . Jacob Wilson's LinkedIn: https://www.linkedin.com/in/jacob--wilson/?originalSubdomain=au…

1
Episode 12 - You're forced to decide: Cyber Generalist or Cyber Specialist? 17:47

منذ 38 weeks17:47

17:47

Send us a text Quotes: “In the fast-paced world of DFIR, you are a mission critical system. Your job isn’t just to uncover what happened during an incident, but to do so in a way that gets results fast.” “Specialists bring expertise that pushes the entire industry forward, while generalists offer versatility and adaptability in the ever-changing landscape of cybersecurity.” “The choice between specializing and generalizing doesn’t always need to be a conscious decision. Often, you just fall into one or the other depending on the work you do day to day.” Resources Mentioned: LinkedIn - Follow TLP Podcast : Follow us on Linked in, and share your thoughts on this episode. Follow TLP Podcast on LinkedIn B-Sides Brisbane Presentation by Ben Gittins : A shout-out was given to Ben Gittins for his presentation on the topic of generalists vs. specialists at B-Sides Brisbane. More about B-Sides Brisbane Volatility - Memory Forensics Tool : Developed by Andrew Case, Volatility is highlighted as an essential tool for memory forensics. Download Volatility Action Points: Reflect on Your Career Path : Consider whether you are currently on the path of specialization or generalization in DFIR. Reflect on how this aligns with your career goals and the needs of your organization. Engage with the Community : The host invites listeners to share their thoughts on the specialist vs. generalist debate on LinkedIn. Join the discussion to see how others in the field are navigating their careers. Stay Updated : Follow the TLP podcast on LinkedIn for more discussions and updates on digital forensics and incident response topics.…

1
Episode 11 - Velociraptor, Containerisation and Infrastructure Deployed as Code with Myles Agnew 52:46

منذ 40 weeks52:46

52:46

Send us a text In this episode of Traffic Light Protocol , we sit down with Myles, a cybersecurity veteran with over 15 years of Cyber experience and background as a Combat Engineer in the Army. Myles brings his unique perspective on integrating automation and cloud technologies into cybersecurity infrastructure deployment (Used specifically when deploying Velciraptor- an advanced open-source endpoint monitoring, digital forensic and cyber response platform). We delve into his journey from the military to his current role in deploying and managing advanced cloud infrastructure using docker containers and kubernetes orchestration platforms. Quotes from Myles : "My time in the Army taught me the value of precision and strategy, which I now apply to cybersecurity." "Cloud environments offer flexibility, but they also demand a new level of vigilance and control." "With containerization, we’re not just deploying applications; we're creating a more secure and manageable environment." Key takeaways: Strategic Integration : Integrating automation and cloud technologies can significantly enhance both the efficiency and effectiveness of cybersecurity practices. Proactive Security Measures : Shifting from reactive to proactive security strategies is essential for staying ahead of emerging threats. Cloud Security Fundamentals : Understanding the fundamentals of containerization and orchestration is crucial for maintaining a secure cloud environment. Efficiency Through Automation : Automation not only speeds up response times but also reduces the likelihood of human error in security processes. Vigilance in Cloud Environments : While cloud technologies offer numerous benefits, they also introduce new security challenges that require continuous vigilance and adaptation. Role of Military Experience : Insights gained from military experience can offer valuable perspectives on discipline, strategy, and precision in cybersecurity practices. Future Trends : Keeping up with trends in automation and cloud security will be key to adapting to future cybersecurity challenges. Links and resources: Contact Myles Website: MylesAgnew.com Github: https://github.com/mylesagnew ASD threat intel: https://www.asd.gov.au/about/what-we-do/cyber-security Tools: Cuckoo Sandbox- https://github.com/cuckoosandbox Wordfence - Available in Wordpress plugins WPS Scan (on Kali Linux) for scanning your own Wordpress site for vulnerabilities Yara Signator: https://github.com/fxb-cocacoding/yara-signator…

1
Episode 10 - Detecting and Preventing Phishing Attacks 19:04

منذ 42 weeks19:04

19:04

Send us a text Quotes: "Phishing targets the human element, the 'wetware,' often the weakest link in any security chain." - Clint Marsden "Phishing isn't just about poorly spelled emails anymore; it's about sophisticated campaigns that even cyber-aware individuals can fall victim to." - Clint Marsden "Effective defense against phishing involves not just technology but ongoing education and a culture of security awareness." - Clint Marsden Key Takeaways: Phishing attacks continue to evolve and remain a significant cybersecurity threat despite advances in technology. Attackers leverage sophisticated techniques including AI and social engineering to exploit human psychology. Effective defense strategies involve a multi-layered approach including user education, advanced email gateway technologies, and stringent access controls. Action Points: Implement ongoing and evolving user education programs to enhance awareness of phishing tactics. Ensure email gateways are configured with DKIM, SPF, and DMARC protocols, and ensure the SEG is tuned appropriately to filter out malicious emails Follow the Essential 8 guidelines, focusing on restricting Microsoft Office macros and restricting admin privileges. If you've got the capacity, go straight into application control. Implement multi-factor authentication (MFA) across all public-facing and internal systems to add an additional layer of security against phishing attempts. Links and references: Mitre ATT&CK - Phishing https://attack.mitre.org/techniques/T1566/ ASD Essential 8: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight IDN Homograph attacks: https://shahjerry33.medium.com/idn-homograph-attack-reborn-of-the-rare-case-99fa1e342352 Phishing Landscape 2023 by Interisle Consulting and APWG: https://www.interisle.net/PhishingLandscape2023.pdf Anti Phishing Working Group: https://apwg.org/trendsreports/…

1
Episode 9 -Unmasking APT40 (Leviathan): Tactics, Challenges, and Defense Strategies 21:48

منذ 43 weeks21:48

21:48

Send us a text Episode Title: "Unmasking APT40: Tactics, Challenges, and Defense Strategies" Key Takeaways: APT40 is a sophisticated Chinese state-sponsored cyber espionage group active since 2009. They target various sectors including academia, aerospace, defense, healthcare, and maritime industries. APT40 uses advanced tactics such as spear phishing, watering hole attacks, and living off the land binaries (LOLBINS). Digital forensics faces challenges in detecting APT40 due to their use of legitimate tools and anti-forensics techniques. Effective defense against APT40 requires a comprehensive, layered security approach. Engaging Quotes: "APT40 represents a significant and evolving threat in the cyber landscape. Their sophisticated attacks, large scope targets and state sponsorship make them a formidable adversary." - Clint Marsden "Defense against groups like APT40 it is not about implementing a single solution. What matters is creating a comprehensive and layered security approach that can adapt to evolving threats." - Clint Marsden Resources Mentioned: MITRE ATT&CK Framework: https://attack.mitre.org/ Pyramid of Pain by David J. Bianco: https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html NIST Computer Security Incident Handling Guide: https://csrc.nist.gov/pubs/sp/800/61/r2/final Sysmon (System Monitor): https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon Action Points: Implement robust email security measures, including secure email gateways and employee training. Keep all systems and software up-to-date to reduce vulnerabilities. Use multi-factor authentication to protect against credential theft. Implement network segmentation to limit lateral movement. Deploy advanced endpoint detection and response (EDR) tools. Conduct regular threat hunting exercises. Implement data loss prevention (DLP) solutions. Develop a comprehensive cloud security strategy.…

1
Episode 8 - Hidden digital forensic logging for Cybersecurity on Any Budget: Practical Strategies for Enhanced Detection and Prevention Using Sysmon, Blocking Data Exfil with group policy and… 19:57

منذ 43 weeks19:57

19:57

Send us a text In this episode, Clint Marsden goes straight into 4 practical strategies that enable better forensics and stop data exfiltration, no matter the size of your budget. Clint covers deploying Sysmon for enhanced monitoring, and using Group Policy to tighten print and USB security. Event log cleared: Event ID 1102 ACSC Sysmon: https://github.com/AustralianCyberSecurityCentre/windows_event_logging Swift on security Sysmon: https://github.com/SwiftOnSecurity/sysmon-config Printer forensics: https://eventlogxp.com/blog/how-to-track-printer-usage-with-event-logs/…

1
Episode 7 - Defending Against Scattered Spider: Understanding Their Tactics, Techniques, and Procedures 17:07

منذ 45 weeks17:07

17:07

Send us a text In todays episode of TLP - Traffic Light Protocol, Clint Marsden talks about Defending Against Scattered Spider: Understanding Their Tactics, Techniques, and Procedures. Key Takeaways Understanding Scattered Spider: Scattered Spider, also known as Roasted Octopus or Octo Tempest, utilizes various legitimate tools for malicious purposes. Common Tools and Techniques: They employ tools for reconnaissance (PingCastle, ADRecon), credential dumping (Mimikatz, Lazagne), Remote access (Screen Connect, Team Viewer), and VPN (Tailscale). Social Engineering Tactics: Their methods include impersonation, MFA fatigue (MFA bombing), and SIM swapping to gain access. Persistence Mechanisms: They maintain access through methods like automatic account linking and adding additional MFA tokens Defense Strategies: Implement strong identity verification, monitor for unusual activity, and educate users social engineering & smishing Quotes "By understanding their tactics, techniques, and procedures, or TTPs, you can better defend your network and improve its security posture." "There's a lot of push on recognizing phishing emails and hovering over links and verifying the sender, but not enough focus on social engineering training for staff" Action Points Review Service Desk Processes: Ensure robust identity verification to prevent social engineering. Monitor for Unusual Activity: Regularly audit and set up automated alerts for suspicious MFA changes or logins. Educate Users: Conduct training on recognizing phishing and social engineering techniques. Test Tools in a Lab: Use the mentioned tools to simulate attacks and improve defensive measures by analyzing security logs and infrastructure. Mentioned Resources Remote monitoring and management or RMM tools Fleetdeck.io Level.io Ngrok Mitre Ref: [S0508] Screenconnect Splashtop Teamviewer Pulseway Tactical RMM Reconnaissance: PingCastle - https://www.pingcastle.com/ ADRecon - https://github.com/sense-of-security/ADRecon Advanced IP Scanner - https://www.advanced-ip-scanner.com/ Govmomi - https://github.com/vmware/govmomi Cred dumpers: Mimikatz - https://github.com/ParrotSec/mimikatz Hekatomb - https://github.com/ProcessusT/HEKATOMB Lazagne - https://github.com/AlessandroZ/LaZagne gosecretsdump - https://github.com/C-Sto/gosecretsdump smbpasswd.py - (as part of Impacket) - https://github.com/fortra/impacket/blob/master/examples/smbpasswd.py LinPEAS - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS ADFSDump - https://github.com/mandiant/ADFSDump VPN: Tailscale - Provides virtual private networks (VPNs) to secure network communications…

1
Episode 6 - Responding to ransomware - is your VPN a target? Plus ransomware risk mitigation with Phil Ngo 26:11

منذ 46 weeks26:11

26:11

Send us a text In this episode, we speak with Phil Ngo, a Primary Investigator in Accenture's global cyber response team. As a primary investigator, he is responsible for helping clients recover from major incidents as well as delivering proactive cyber services, such as threat hunting and tabletop exercises. Philip started his career as a high school teacher, before moving into IT support and eventually into cyber security six years ago. Philip has a worked across multiple industries and through his experience, has built up a solid cyber forensics and response skillset. Get some tactical assistance with Phil's real life high-pressure incident experience. In this episode we cover: Challenges in Digital Forensics: Obstacles in digital forensics and incident response - working people and systems Frequent vulnerabilities exploited in breaches The potential impact of AI on digital forensics and incident response Essential qualities and resources for aspiring cybersecurity professionals Connect with Phil on LinkedIn here: https://www.linkedin.com/in/phil-ngo1337/ Youtube channels for additional learning: 13 Cubed www.youtube.com/@13Cubed Network Chuck: http://www.youtube.com/@NetworkChuck http://www.youtube.com/@SANSForensics…

منذ 51 weeks23:27

23:27

Send us a text In this first episode we kick off with Clint Marsden, the host of Traffic Light Protocol (TLP) where he talks about what its like to work in DFIR, how to get started with Cyber training, what to expect in future episodes, and of course a light touch on AI Forensics! Join us for the first episode. The next episodes coming up talk about the NIST SP 800-61 where we break down Preparation, Detection, Eradication and Recovery. Highlights: Current trends and best practices in digital forensics, emphasizing the importance of preparation, experience across different domains, and the challenges of acquiring artifacts. Clint highlights the need for a wide breadth of experience and stressed the importance of continuous learning, while emphasising the need for a broad range of tools and methods. Finally, we also discussed various methods for learning cybersecurity without spending money, including exploring free resources and leveraging AI.…

مرحبًا بك في مشغل أف ام!

يقوم برنامج مشغل أف أم بمسح الويب للحصول على بودكاست عالية الجودة لتستمتع بها الآن. إنه أفضل تطبيق بودكاست ويعمل على أجهزة اندرويد والأيفون والويب. قم بالتسجيل لمزامنة الاشتراكات عبر الأجهزة.