Эпизоды
-
Send us a text
Key Takeaways:
Introduction to Hayabusa: Hayabusa is an open-source Windows Event Log Analysis Tool used for processing EVTX logs to detect suspicious activities in Windows environments.Critical Alerts Detection: The tool is capable of detecting a variety of suspicious activities, including WannaCry ransomware and unauthorized Active Directory replication.Efficient Incident Response: Hayabusa is ideal for incident response workflows, enabling teams to quickly triage and analyze Windows logs to detect potential breaches or malicious activity.Importance of Informational Alerts: Informational alerts can indicate early reconnaissance phases of attacks and should not be dismissed.Hypothesis-Driven Threat Hunting: Build a threat hunting hypothesis using MITRE ATT&CK or industry-specific threat intelligence to narrow the focus of the search.Integration with SIEM and TimeSketch: Hayabusa supports integration with security tools like SIEM and can export logs into TimeSketch for further analysis and visualization.Open-source and Free: Hayabusa is freely available to the cybersecurity community, making it an essential tool for threat detection without added cost. -
Send us a text
In this episode of Traffic Light Protocol, Clint Marsden is joined by Jonathan Thompson, a developer and AI enthusiast currently studying at Macquarie University.
Together, they dive into how artificial intelligence (AI) is transforming the cybersecurity landscape and discuss Jon’s insights into AI’s potential applications in digital forensics, incident response, and everyday IT operations.
The conversation touches on ethical considerations, potential job impacts, and how AI can be harnessed to streamline tasks like log analysis, bug detection, and threat identification.
Daniel Kahneman - Thinking Fast and Slow
https://amzn.to/47Cpfjo
The pyramid of pain by David J Bianco: http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html -
Пропущенные эпизоды?
-
Send us a text
Episode 13 is another giant episode with a focus on what its like be in the mud working on real life forensic investigations. Jacob and Clint talk about ELK EDR, using Sysmon.
Sandbox Environments: Jacob discusses the creation of a sandbox environment using an ELK stack combined with Sysmon, enabling in-depth malware analysis by capturing and analyzing detailed system activity.Automation in Investigations: Jacob emphasizes the importance of automating repetitive tasks, such as business email compromise investigations, to streamline processes and improve efficiency.
Pen Testing and Red Teaming: Jacob shares insights into the importance of understanding both offensive (red teaming) and defensive (blue teaming) techniques to better anticipate and mitigate threats.Practical Learning: Jacob advocates for hands-on experience in digital forensics, highlighting the limitations of theoretical knowledge and the value of real-world application.
ELK Stack: Used for creating a detailed sandbox environment for malware analysis. Learn more about ELK Stack here.Sysmon: Essential tool for capturing detailed logs on Windows systems. Explore Sysmon here.Axiom: A commercial digital forensics tool praised for its comprehensive and reliable results. More about Axiom here.Cellebrite: A tool used for mobile device forensics, particularly for logical acquisitions. Discover Cellebrite here.Splunk: Utilized for automating the investigation process by analyzing large datasets quickly. More on Splunk here.
Resources Mentioned:Jacob Wilson's LinkedIn: https://www.linkedin.com/in/jacob--wilson/?originalSubdomain=au
-
Send us a text
Quotes:
“In the fast-paced world of DFIR, you are a mission critical system. Your job isn’t just to uncover what happened during an incident, but to do so in a way that gets results fast.”“Specialists bring expertise that pushes the entire industry forward, while generalists offer versatility and adaptability in the ever-changing landscape of cybersecurity.”“The choice between specializing and generalizing doesn’t always need to be a conscious decision. Often, you just fall into one or the other depending on the work you do day to day.”Resources Mentioned:
LinkedIn - Follow TLP Podcast: Follow us on Linked in, and share your thoughts on this episode. Follow TLP Podcast on LinkedInB-Sides Brisbane Presentation by Ben Gittins: A shout-out was given to Ben Gittins for his presentation on the topic of generalists vs. specialists at B-Sides Brisbane. More about B-Sides BrisbaneVolatility - Memory Forensics Tool: Developed by Andrew Case, Volatility is highlighted as an essential tool for memory forensics. Download VolatilityAction Points:
Reflect on Your Career Path: Consider whether you are currently on the path of specialization or generalization in DFIR. Reflect on how this aligns with your career goals and the needs of your organization.Engage with the Community: The host invites listeners to share their thoughts on the specialist vs. generalist debate on LinkedIn. Join the discussion to see how others in the field are navigating their careers.Stay Updated: Follow the TLP podcast on LinkedIn for more discussions and updates on digital forensics and incident response topics. -
Send us a text
In this episode of Traffic Light Protocol, we sit down with Myles, a cybersecurity veteran with over 15 years of Cyber experience and background as a Combat Engineer in the Army. Myles brings his unique perspective on integrating automation and cloud technologies into cybersecurity infrastructure deployment (Used specifically when deploying Velciraptor- an advanced open-source endpoint monitoring, digital forensic and cyber response platform).
"My time in the Army taught me the value of precision and strategy, which I now apply to cybersecurity." "Cloud environments offer flexibility, but they also demand a new level of vigilance and control." "With containerization, we’re not just deploying applications; we're creating a more secure and manageable environment."
We delve into his journey from the military to his current role in deploying and managing advanced cloud infrastructure using docker containers and kubernetes orchestration platforms.
Quotes from Myles:Key takeaways:
Proactive Security Measures: Shifting from reactive to proactive security strategies is essential for staying ahead of emerging threats.Cloud Security Fundamentals: Understanding the fundamentals of containerization and orchestration is crucial for maintaining a secure cloud environment.Efficiency Through Automation: Automation not only speeds up response times but also reduces the likelihood of human error in security processes.Vigilance in Cloud Environments: While cloud technologies offer numerous benefits, they also introduce new security challenges that require continuous vigilance and adaptation.Role of Military Experience: Insights gained from military experience can offer valuable perspectives on discipline, strategy, and precision in cybersecurity practices.Future Trends: Keeping up with trends in automation and cloud security will be key to adapting to future cybersecurity challenges.
Strategic Integration: Integrating automation and cloud technologies can significantly enhance both the efficiency and effectiveness of cybersecurity practices.Links and resources:
Contact Myles
Website: MylesAgnew.com
Github: https://github.com/mylesagnew
ASD threat intel:
https://www.asd.gov.au/about/what-we-do/cyber-security
Tools:
Cuckoo Sandbox- https://github.com/cuckoosandbox
Wordfence - Available in Wordpress plugins
WPS Scan (on Kali Linux) for scanning your own Wordpress site for vulnerabilities
Yara Signator: https://github.com/fxb-cocacoding/yara-signator -
Send us a text
Quotes:
Phishing attacks continue to evolve and remain a significant cybersecurity threat despite advances in technology. Attackers leverage sophisticated techniques including AI and social engineering to exploit human psychology. Effective defense strategies involve a multi-layered approach including user education, advanced email gateway technologies, and stringent access controls.
"Phishing targets the human element, the 'wetware,' often the weakest link in any security chain." - Clint Marsden
"Phishing isn't just about poorly spelled emails anymore; it's about sophisticated campaigns that even cyber-aware individuals can fall victim to." - Clint Marsden
"Effective defense against phishing involves not just technology but ongoing education and a culture of security awareness." - Clint Marsden
Key Takeaways:
Implement ongoing and evolving user education programs to enhance awareness of phishing tactics. Ensure email gateways are configured with DKIM, SPF, and DMARC protocols, and ensure the SEG is tuned appropriately to filter out malicious emails Follow the Essential 8 guidelines, focusing on restricting Microsoft Office macros and restricting admin privileges. If you've got the capacity, go straight into application control. Implement multi-factor authentication (MFA) across all public-facing and internal systems to add an additional layer of security against phishing attempts.
Action Points:
Links and references:
Mitre ATT&CK - Phishing
https://attack.mitre.org/techniques/T1566/
ASD Essential 8:
https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight
IDN Homograph attacks:
https://shahjerry33.medium.com/idn-homograph-attack-reborn-of-the-rare-case-99fa1e342352
Phishing Landscape 2023 by Interisle Consulting and APWG:
https://www.interisle.net/PhishingLandscape2023.pdf
Anti Phishing Working Group:
https://apwg.org/trendsreports/ -
Send us a text
Episode Title: "Unmasking APT40: Tactics, Challenges, and Defense Strategies"
Key Takeaways:
APT40 is a sophisticated Chinese state-sponsored cyber espionage group active since 2009.
They target various sectors including academia, aerospace, defense, healthcare, and maritime industries.
APT40 uses advanced tactics such as spear phishing, watering hole attacks, and living off the land binaries (LOLBINS).
Digital forensics faces challenges in detecting APT40 due to their use of legitimate tools and anti-forensics techniques.
Effective defense against APT40 requires a comprehensive, layered security approach.
Engaging Quotes:
"APT40 represents a significant and evolving threat in the cyber landscape. Their sophisticated attacks, large scope targets and state sponsorship make them a formidable adversary." - Clint Marsden
"Defense against groups like APT40 it is not about implementing a single solution. What matters is creating a comprehensive and layered security approach that can adapt to evolving threats." - Clint Marsden
Resources Mentioned:
MITRE ATT&CK Framework: https://attack.mitre.org/
Pyramid of Pain by David J. Bianco: https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
NIST Computer Security Incident Handling Guide: https://csrc.nist.gov/pubs/sp/800/61/r2/final
Sysmon (System Monitor): https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
Action Points:
Implement robust email security measures, including secure email gateways and employee training.
Keep all systems and software up-to-date to reduce vulnerabilities.
Use multi-factor authentication to protect against credential theft.
Implement network segmentation to limit lateral movement.
Deploy advanced endpoint detection and response (EDR) tools.
Conduct regular threat hunting exercises.
Implement data loss prevention (DLP) solutions.
Develop a comprehensive cloud security strategy. -
Send us a text
In this episode, Clint Marsden goes straight into 4 practical strategies that enable better forensics and stop data exfiltration, no matter the size of your budget.
Clint covers deploying Sysmon for enhanced monitoring, and using Group Policy to tighten print and USB security.Event log cleared: Event ID 1102
ACSC Sysmon: https://github.com/AustralianCyberSecurityCentre/windows_event_logging
Swift on security Sysmon: https://github.com/SwiftOnSecurity/sysmon-config
Printer forensics: https://eventlogxp.com/blog/how-to-track-printer-usage-with-event-logs/ -
Send us a text
In todays episode of TLP - Traffic Light Protocol, Clint Marsden talks about Defending Against Scattered Spider: Understanding Their Tactics, Techniques, and Procedures.
Key Takeaways
Understanding Scattered Spider: Scattered Spider, also known as Roasted Octopus or Octo Tempest, utilizes various legitimate tools for malicious purposes.
Common Tools and Techniques: They employ tools for reconnaissance (PingCastle, ADRecon), credential dumping (Mimikatz, Lazagne), Remote access (Screen Connect, Team Viewer), and VPN (Tailscale).
Social Engineering Tactics: Their methods include impersonation, MFA fatigue (MFA bombing), and SIM swapping to gain access.
Persistence Mechanisms: They maintain access through methods like automatic account linking and adding additional MFA tokens
Defense Strategies: Implement strong identity verification, monitor for unusual activity, and educate users social engineering & smishing
Quotes
"By understanding their tactics, techniques, and procedures, or TTPs, you can better defend your network and improve its security posture."
"There's a lot of push on recognizing phishing emails and hovering over links and verifying the sender, but not enough focus on social engineering training for staff"
Action Points
Review Service Desk Processes: Ensure robust identity verification to prevent social engineering.
Monitor for Unusual Activity: Regularly audit and set up automated alerts for suspicious MFA changes or logins.
Educate Users: Conduct training on recognizing phishing and social engineering techniques.
Test Tools in a Lab: Use the mentioned tools to simulate attacks and improve defensive measures by analyzing security logs and infrastructure.
Mentioned Resources
Remote monitoring and management or RMM tools
Fleetdeck.io
Level.io
Ngrok Mitre Ref: [S0508]
Screenconnect
Splashtop
Teamviewer
Pulseway
Tactical RMM
Reconnaissance:
PingCastle - https://www.pingcastle.com/
ADRecon - https://github.com/sense-of-security/ADRecon
Advanced IP Scanner - https://www.advanced-ip-scanner.com/
Govmomi - https://github.com/vmware/govmomi
Cred dumpers:
Mimikatz - https://github.com/ParrotSec/mimikatz
Hekatomb - https://github.com/ProcessusT/HEKATOMB
Lazagne - https://github.com/AlessandroZ/LaZagne
gosecretsdump - https://github.com/C-Sto/gosecretsdump
smbpasswd.py - (as part of Impacket) - https://github.com/fortra/impacket/blob/master/examples/smbpasswd.py
LinPEAS - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
ADFSDump - https://github.com/mandiant/ADFSDump
VPN:
Tailscale - Provides virtual private networks (VPNs) to secure network communications
-
Send us a text
In this episode, we speak with Phil Ngo, a Primary Investigator in Accenture's global cyber response team.
As a primary investigator, he is responsible for helping clients recover from major incidents as well as delivering proactive cyber services, such as threat hunting and tabletop exercises. Philip started his career as a high school teacher, before moving into IT support and eventually into cyber security six years ago. Philip has a worked across multiple industries and through his experience, has built up a solid cyber forensics and response skillset.
Get some tactical assistance with Phil's real life high-pressure incident experience. In this episode we cover:
Challenges in Digital Forensics:
Obstacles in digital forensics and incident response - working people and systems
Frequent vulnerabilities exploited in breaches
The potential impact of AI on digital forensics and incident response
Essential qualities and resources for aspiring cybersecurity professionals
Connect with Phil on LinkedIn here:
https://www.linkedin.com/in/phil-ngo1337/
Youtube channels for additional learning:
13 Cubed www.youtube.com/@13Cubed
Network Chuck: http://www.youtube.com/@NetworkChuck
http://www.youtube.com/@SANSForensics -
Send us a text
This is the biggest episode from a content perspective so far. I'm excited to share it with you.
How to run post-incident debriefs and post-mortems.Involving external teamsUsing lessons learned to form actionable insights.Key questions to address in incident analysis.Effective report writing strategies, including timelines and executive summaries.Evaluating and improving incident response procedures and tools preparation.Engaging broader teams in the debrief process for better cooperation.Tracking and documenting incident response efforts for continuous improvement.
Episode Highlights:Key Takeaways:
Post-incident debriefs and post-mortems afford the most value for learning, improving incident response and preventing reoccurance.Using structured frameworks and guidelines, like NIST 800-61, provide valuable direction for how to run your debrief and post-mortem meeting.Effective communication, documentation, and cooperation across teams enhance incident handling and future preparedness. -
Send us a text
Show Notes: Episode on Containment, Eradication, and Recovery
In this episode of Traffic Light Protocol, Clint Marsden explores the containment, eradication, and recovery phases of the NIST SP 800-61 framework for computer security incident handling.
Key Topics Covered:
Containment Strategies: Choosing appropriate containment methods based on the incident type, potential damage, service availability, and evidence preservation. Examples include power disconnection and network isolation.Real-World Example: Clint shares an incident response case where premature action against attackers led to a total domain takeover.Evidence Gathering and Handling: The use of tools like write blockers to preserve evidence integrity.Threat Analysis: Highlights passive techniques for analysing threats without alerting attackers, such as remote log analysis and OPSEC to track attackersRestoration and Recovery: Covers steps to restore systems to normal operations, including vulnerability patching, backup restoration, and password resets.Future Considerations: Suggests engaging with external vendors for comprehensive incident response and utilizing threat intelligence platforms.Join Clint Marsden as he guides you through the intricacies of incident response, helping you enhance your digital forensics skills. Follow Clint Marsden on LinkedIn (https://www.linkedin.com/in/clintmarsden/) and TLP on Linked In https://www.linkedin.com/company/traffic-light-protocol-the-digital-forensics-podcast-tlp for more updates and insights.
-
Send us a text
In this conclusion of the Detection phase, Clint wraps up Incident Prioritisation. This includes Functional impacts of the incident, information impact of the incident and the recoverability of the incident.
Not all of these are needed, or relevant when tracking your incident and Clint explains when to categorise incidents using these factors.
To finish off, Clint discusses incident notification - Who are the stakeholders that need to be informed and included in your incident response process, and how will they be notified?
Auscert: www.auscert.org.au -
Send us a text
In this 45 minute episode Clint covers a lot of ground based on the Detection phase of NIST 800-61.
Attack vectors for digital security incidents, including insider threats and weaponized USBs.
Cybersecurity incident response and detection, including NIST guidelines and Sysmon logging augmentation
The importance of following temporal linearity in Forensic Investigations, expanding analysis to 5-10 minutes prior to and after events, particularly in Internet History and Memory Dumps
Building a baseline of activity through network pcaps and log analysis
Why synchronised clocks are important?
How detailed notes help in your investigations -
Send us a text
In this Episode Clint Marsden talks about the first phase of Computer Security Incident Handling according to NIST. Listen to real world examples of how to get prepared before a Cyber Security Incident arrives.
Show notes:
Link to NIST SP 800-61 PDF
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Bro has been renamed to Zeek. https://zeek.org/
Rita is Real Intelligence Threat Analytics. Created by Active Countermeasures -
Available from https://github.com/activecm/rita -
Send us a text
In this first episode we kick off with Clint Marsden, the host of Traffic Light Protocol (TLP) where he talks about what its like to work in DFIR, how to get started with Cyber training, what to expect in future episodes, and of course a light touch on AI Forensics!
Join us for the first episode. The next episodes coming up talk about the NIST SP 800-61 where we break down Preparation, Detection, Eradication and Recovery.
Highlights:
Current trends and best practices in digital forensics, emphasizing the importance of preparation, experience across different domains, and the challenges of acquiring artifacts. Clint highlights the need for a wide breadth of experience and stressed the importance of continuous learning, while emphasising the need for a broad range of tools and methods.
Finally, we also discussed various methods for learning cybersecurity without spending money, including exploring free resources and leveraging AI.
