Episode 8 - Hidden digital forensic logging for Cybersecurity on Any Budget: Practical Strategies for Enhanced Detection and Prevention Using Sysmon, Blocking Data Exfil with group policy and printer forensics

TLP - The Digital Forensics Podcast

07/07/24 • 19 min

Send us a text

In this episode, Clint Marsden goes straight into 4 practical strategies that enable better forensics and stop data exfiltration, no matter the size of your budget.
Clint covers deploying Sysmon for enhanced monitoring, and using Group Policy to tighten print and USB security.

Event log cleared: Event ID 1102
ACSC Sysmon: https://github.com/AustralianCyberSecurityCentre/windows_event_logging
Swift on security Sysmon: https://github.com/SwiftOnSecurity/sysmon-config
Printer forensics: https://eventlogxp.com/blog/how-to-track-printer-usage-with-event-logs/

07/07/24 • 19 min

TLP - The Digital Forensics Podcast - Episode 8 - Hidden digital forensic logging for Cybersecurity on Any Budget: Practical Strategies for Enhanced Detection and Prevention Using Sysmon, Blocking Data Exfil with group policy and printer forensics

Transcript

Welcome to another episode of TLP, Traffic Light Protocol, the digital forensics podcast, where we talk about what it's really like day-to-day responding to incidents using forensic tools, threat hunting and staying on top of everything in the DFIR space. I'm your host Clint Marsden and today we're focusing on improving your detective and preventative capabilities for forensic analysis in security, with a special emphasis on empowering organizations of varying sizes and varying budgets. Jake W

Generate a badge

Get a badge for your website that links back to this episode

Select type & size

Copy