TLP - The Digital Forensics Podcast
Clint Marsden
Get involved in the exciting world of Digital Forensics and Incident Response with: Traffic Light Protocol. The Digital Forensics Podcast.
In each episode, we sit down with seasoned DFIR professionals, the blueteamers who work around the clock to investigate cyber intrusions. From data breaches to cyberattacks, they share firsthand accounts of some of the most intense investigations they've ever tackled, how they deal with burnout and the added pressure of cat and mouse while they learn about new attack chains.
All episodes
Best episodes
Seasons
Top 10 TLP - The Digital Forensics Podcast Episodes
Goodpods has curated a list of the 10 best TLP - The Digital Forensics Podcast episodes, ranked by the number of listens and likes each episode have garnered from our listeners. If you are listening to TLP - The Digital Forensics Podcast for the first time, there's no better place to start than with one of these standout episodes. If you are a fan of the show, vote for your favorite TLP - The Digital Forensics Podcast episode by adding your comments to the episode page.
Episode 9 -Unmasking APT40 (Leviathan): Tactics, Challenges, and Defense Strategies
TLP - The Digital Forensics Podcast
07/12/24 • 21 min
Episode Title: "Unmasking APT40: Tactics, Challenges, and Defense Strategies"
Key Takeaways:
APT40 is a sophisticated Chinese state-sponsored cyber espionage group active since 2009.
They target various sectors including academia, aerospace, defense, healthcare, and maritime industries.
APT40 uses advanced tactics such as spear phishing, watering hole attacks, and living off the land binaries (LOLBINS).
Digital forensics faces challenges in detecting APT40 due to their use of legitimate tools and anti-forensics techniques.
Effective defense against APT40 requires a comprehensive, layered security approach.
Engaging Quotes:
"APT40 represents a significant and evolving threat in the cyber landscape. Their sophisticated attacks, large scope targets and state sponsorship make them a formidable adversary." - Clint Marsden
"Defense against groups like APT40 it is not about implementing a single solution. What matters is creating a comprehensive and layered security approach that can adapt to evolving threats." - Clint Marsden
Resources Mentioned:
MITRE ATT&CK Framework: https://attack.mitre.org/
Pyramid of Pain by David J. Bianco: https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
NIST Computer Security Incident Handling Guide: https://csrc.nist.gov/pubs/sp/800/61/r2/final
Sysmon (System Monitor): https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
Action Points:
Implement robust email security measures, including secure email gateways and employee training.
Keep all systems and software up-to-date to reduce vulnerabilities.
Use multi-factor authentication to protect against credential theft.
Implement network segmentation to limit lateral movement.
Deploy advanced endpoint detection and response (EDR) tools.
Conduct regular threat hunting exercises.
Implement data loss prevention (DLP) solutions.
Develop a comprehensive cloud security strategy.
Episode 7 - Defending Against Scattered Spider: Understanding Their Tactics, Techniques, and Procedures
TLP - The Digital Forensics Podcast
06/25/24 • 17 min
In todays episode of TLP - Traffic Light Protocol, Clint Marsden talks about Defending Against Scattered Spider: Understanding Their Tactics, Techniques, and Procedures.
Key Takeaways
Understanding Scattered Spider: Scattered Spider, also known as Roasted Octopus or Octo Tempest, utilizes various legitimate tools for malicious purposes.
Common Tools and Techniques: They employ tools for reconnaissance (PingCastle, ADRecon), credential dumping (Mimikatz, Lazagne), Remote access (Screen Connect, Team Viewer), and VPN (Tailscale).
Social Engineering Tactics: Their methods include impersonation, MFA fatigue (MFA bombing), and SIM swapping to gain access.
Persistence Mechanisms: They maintain access through methods like automatic account linking and adding additional MFA tokens
Defense Strategies: Implement strong identity verification, monitor for unusual activity, and educate users social engineering & smishing
Quotes
"By understanding their tactics, techniques, and procedures, or TTPs, you can better defend your network and improve its security posture."
"There's a lot of push on recognizing phishing emails and hovering over links and verifying the sender, but not enough focus on social engineering training for staff"
Action Points
Review Service Desk Processes: Ensure robust identity verification to prevent social engineering.
Monitor for Unusual Activity: Regularly audit and set up automated alerts for suspicious MFA changes or logins.
Educate Users: Conduct training on recognizing phishing and social engineering techniques.
Test Tools in a Lab: Use the mentioned tools to simulate attacks and improve defensive measures by analyzing security logs and infrastructure.
Mentioned Resources
Remote monitoring and management or RMM tools
Fleetdeck.io
Level.io
Ngrok Mitre Ref: [S0508]
Screenconnect
Splashtop
Teamviewer
Pulseway
Tactical RMM
Reconnaissance:
PingCastle - https://www.pingcastle.com/
ADRecon - https://github.com/sense-of-security/ADRecon
Advanced IP Scanner - https://www.advanced-ip-scanner.com/
Govmomi - https://github.com/vmware/govmomi
Cred dumpers:
Mimikatz - https://github.com/ParrotSec/mimikatz
Hekatomb - https://github.com/ProcessusT/HEKATOMB
Lazagne - https://github.com/AlessandroZ/LaZagne
gosecretsdump - https://github.com/C-Sto/gosecretsdump
smbpasswd.py - (as part of Impacket) - https://github.com/fortra/impacket/blob/master/examples/smbpasswd.py
LinPEAS - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
ADFSDump - https://github.com/mandiant/ADFSDump
VPN:
Tailscale - Provides virtual private networks (VPNs) to secure network communications
Episode 14 - AI and the future of log analysis, bug detection, forensics and AI ethical considerations with Jonathan Thompson
TLP - The Digital Forensics Podcast
09/22/24 • 68 min
In this episode of Traffic Light Protocol, Clint Marsden is joined by Jonathan Thompson, a developer and AI enthusiast currently studying at Macquarie University.
Together, they dive into how artificial intelligence (AI) is transforming the cybersecurity landscape and discuss Jon’s insights into AI’s potential applications in digital forensics, incident response, and everyday IT operations.
The conversation touches on ethical considerations, potential job impacts, and how AI can be harnessed to streamline tasks like log analysis, bug detection, and threat identification.
Daniel Kahneman - Thinking Fast and Slow
https://amzn.to/47Cpfjo
The pyramid of pain by David J Bianco: http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
Episode 11 - Velociraptor, Containerisation and Infrastructure Deployed as Code with Myles Agnew
TLP - The Digital Forensics Podcast
07/29/24 • 52 min
In this episode of Traffic Light Protocol, we sit down with Myles, a cybersecurity veteran with over 15 years of Cyber experience and background as a Combat Engineer in the Army. Myles brings his unique perspective on integrating automation and cloud technologies into cybersecurity infrastructure deployment (Used specifically when deploying Velciraptor- an advanced open-source endpoint monitoring, digital forensic and cyber response platform).
We delve into his journey from the military to his current role in deploying and managing advanced cloud infrastructure using docker containers and kubernetes orchestration platforms.
Quotes from Myles:
- "My time in the Army taught me the value of precision and strategy, which I now apply to cybersecurity."
- "Cloud environments offer flexibility, but they also demand a new level of vigilance and control."
- "With containerization, we’re not just deploying applications; we're creating a more secure and manageable environment."
Key takeaways:
Strategic Integration: Integrating automation and cloud technologies can significantly enhance both the efficiency and effectiveness of cybersecurity practices.
- Proactive Security Measures: Shifting from reactive to proactive security strategies is essential for staying ahead of emerging threats.
- Cloud Security Fundamentals: Understanding the fundamentals of containerization and orchestration is crucial for maintaining a secure cloud environment.
- Efficiency Through Automation: Automation not only speeds up response times but also reduces the likelihood of human error in security processes.
- Vigilance in Cloud Environments: While cloud technologies offer numerous benefits, they also introduce new security challenges that require continuous vigilance and adaptation.
- Role of Military Experience: Insights gained from military experience can offer valuable perspectives on discipline, strategy, and precision in cybersecurity practices.
- Future Trends: Keeping up with trends in automation and cloud security will be key to adapting to future cybersecurity challenges.
Links and resources:
Contact Myles
Website: MylesAgnew.com
Github: https://github.com/mylesagnew
ASD threat intel:
https://www.asd.gov.au/about/what-we-do/cyber-security
Tools:
Cuckoo Sandbox- https://github.com/cuckoosandbox
Wordfence - Available in Wordpress plugins
WPS Scan (on Kali Linux) for scanning your own Wordpress site for vulnerabilities
Yara Signator: https://github.com/fxb-cocacoding/yara-signator
Episode 10 - Detecting and Preventing Phishing Attacks
TLP - The Digital Forensics Podcast
07/17/24 • 19 min
Quotes:
"Phishing targets the human element, the 'wetware,' often the weakest link in any security chain." - Clint Marsden
"Phishing isn't just about poorly spelled emails anymore; it's about sophisticated campaigns that even cyber-aware individuals can fall victim to." - Clint Marsden
"Effective defense against phishing involves not just technology but ongoing education and a culture of security awareness." - Clint Marsden
Key Takeaways:
- Phishing attacks continue to evolve and remain a significant cybersecurity threat despite advances in technology.
- Attackers leverage sophisticated techniques including AI and social engineering to exploit human psychology.
- Effective defense strategies involve a multi-layered approach including user education, advanced email gateway technologies, and stringent access controls.
Action Points:
- Implement ongoing and evolving user education programs to enhance awareness of phishing tactics.
- Ensure email gateways are configured with DKIM, SPF, and DMARC protocols, and ensure the SEG is tuned appropriately to filter out malicious emails
- Follow the Essential 8 guidelines, focusing on restricting Microsoft Office macros and restricting admin privileges. If you've got the capacity, go straight into application control.
- Implement multi-factor authentication (MFA) across all public-facing and internal systems to add an additional layer of security against phishing attempts.
Links and references:
Mitre ATT&CK - Phishing
https://attack.mitre.org/techniques/T1566/
ASD Essential 8:
https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight
IDN Homograph attacks:
https://shahjerry33.medium.com/idn-homograph-attack-reborn-of-the-rare-case-99fa1e342352
Phishing Landscape 2023 by Interisle Consulting and APWG:
https://www.interisle.net/PhishingLandscape2023.pdf
Anti Phishing Working Group:
https://apwg.org/trendsreports/
Episode 6 - Responding to ransomware - is your VPN a target? Plus ransomware risk mitigation with Phil Ngo
TLP - The Digital Forensics Podcast
06/20/24 • 26 min
In this episode, we speak with Phil Ngo, a Primary Investigator in Accenture's global cyber response team.
As a primary investigator, he is responsible for helping clients recover from major incidents as well as delivering proactive cyber services, such as threat hunting and tabletop exercises. Philip started his career as a high school teacher, before moving into IT support and eventually into cyber security six years ago. Philip has a worked across multiple industries and through his experience, has built up a solid cyber forensics and response skillset.
Get some tactical assistance with Phil's real life high-pressure incident experience. In this episode we cover:
Challenges in Digital Forensics:
Obstacles in digital forensics and incident response - working people and systems
Frequent vulnerabilities exploited in breaches
The potential impact of AI on digital forensics and incident response
Essential qualities and resources for aspiring cybersecurity professionals
Connect with Phil on LinkedIn here:
https://www.linkedin.com/in/phil-ngo1337/
Youtube channels for additional learning:
13 Cubed www.youtube.com/@13Cubed
Network Chuck: http://www.youtube.com/@NetworkChuck
http://www.youtube.com/@SANSForensics
Episode 3 - NIST SP 800-61 Computer Security Incident Handling Guide (Detection)
TLP - The Digital Forensics Podcast
05/28/24 • 46 min
In this 45 minute episode Clint covers a lot of ground based on the Detection phase of NIST 800-61.
Attack vectors for digital security incidents, including insider threats and weaponized USBs.
Cybersecurity incident response and detection, including NIST guidelines and Sysmon logging augmentation
The importance of following temporal linearity in Forensic Investigations, expanding analysis to 5-10 minutes prior to and after events, particularly in Internet History and Memory Dumps
Building a baseline of activity through network pcaps and log analysis
Why synchronised clocks are important?
How detailed notes help in your investigations
Episode 13-ELK EDR and Sandboxing, Home grown CTF environments, DFIR Automation & Forensics in the cloud, with Jacob Wilson
TLP - The Digital Forensics Podcast
08/20/24 • 54 min
Episode 13 is another giant episode with a focus on what its like be in the mud working on real life forensic investigations. Jacob and Clint talk about ELK EDR, using Sysmon.
Sandbox Environments: Jacob discusses the creation of a sandbox environment using an ELK stack combined with Sysmon, enabling in-depth malware analysis by capturing and analyzing detailed system activity.
Automation in Investigations: Jacob emphasizes the importance of automating repetitive tasks, such as business email compromise investigations, to streamline processes and improve efficiency.
Pen Testing and Red Teaming: Jacob shares insights into the importance of understanding both offensive (red teaming) and defensive (blue teaming) techniques to better anticipate and mitigate threats.
Practical Learning: Jacob advocates for hands-on experience in digital forensics, highlighting the limitations of theoretical knowledge and the value of real-world application.
Resources Mentioned:
- ELK Stack: Used for creating a detailed sandbox environment for malware analysis. Learn more about ELK Stack here.
- Sysmon: Essential tool for capturing detailed logs on Windows systems. Explore Sysmon here.
- Axiom: A commercial digital forensics tool praised for its comprehensive and reliable results. More about Axiom here.
- Cellebrite: A tool used for mobile device forensics, particularly for logical acquisitions. Discover Cellebrite here.
- Splunk: Utilized for automating the investigation process by analyzing large datasets quickly. More on Splunk here.
Jacob Wilson's LinkedIn: https://www.linkedin.com/in/jacob--wilson/?originalSubdomain=au
In this episode, Clint Marsden goes straight into 4 practical strategies that enable better forensics and stop data exfiltration, no matter the size of your budget.
Clint covers deploying Sysmon for enhanced monitoring, and using Group Policy to tighten print and USB security.
Event log cleared: Event ID 1102
ACSC Sysmon: https://github.com/AustralianCyberSecurityCentre/windows_event_logging
Swift on security Sysmon: https://github.com/SwiftOnSecurity/sysmon-config
Printer forensics: https://eventlogxp.com/blog/how-to-track-printer-usage-with-event-logs/
Episode 5 - NIST SP 800-61 Computer Security Incident Handling Guide (Post-Incident Activity)
TLP - The Digital Forensics Podcast
06/12/24 • 33 min
This is the biggest episode from a content perspective so far. I'm excited to share it with you.
Episode Highlights:
- How to run post-incident debriefs and post-mortems.
- Involving external teams
- Using lessons learned to form actionable insights.
- Key questions to address in incident analysis.
- Effective report writing strategies, including timelines and executive summaries.
- Evaluating and improving incident response procedures and tools preparation.
- Engaging broader teams in the debrief process for better cooperation.
- Tracking and documenting incident response efforts for continuous improvement.
Key Takeaways:
- Post-incident debriefs and post-mortems afford the most value for learning, improving incident response and preventing reoccurance.
- Using structured frameworks and guidelines, like NIST 800-61, provide valuable direction for how to run your debrief and post-mortem meeting.
- Effective communication, documentation, and cooperation across teams enhance incident handling and future preparedness.
Show more best episodes
Show more best episodes
FAQ
How many episodes does TLP - The Digital Forensics Podcast have?
TLP - The Digital Forensics Podcast currently has 16 episodes available.
What topics does TLP - The Digital Forensics Podcast cover?
The podcast is about Hacking, Windows, Podcasts, Technology and Cyber.
What is the most popular episode on TLP - The Digital Forensics Podcast?
The episode title 'Episode 11 - Velociraptor, Containerisation and Infrastructure Deployed as Code with Myles Agnew' is the most popular.
What is the average episode length on TLP - The Digital Forensics Podcast?
The average episode length on TLP - The Digital Forensics Podcast is 30 minutes.
How often are episodes of TLP - The Digital Forensics Podcast released?
Episodes of TLP - The Digital Forensics Podcast are typically released every 7 days.
When was the first episode of TLP - The Digital Forensics Podcast?
The first episode of TLP - The Digital Forensics Podcast was released on May 16, 2024.
Show more FAQ
Show more FAQ