Send us a text

Link to IRCO- Incident Response Copilot on Chat  GPT

https://chatgpt.com/g/g-68033ce1b26481919b26df0737241bac-irco-incident-response-co-pilot

In this episode of TLP: The Digital Forensics Podcast, Clint dives deep into IRCO (a custom GPT designed specifically for DFIR and SOC analysts). From real-world cyber incidents to post-incident reporting and CTF training, IRCO acts like your AI-powered colleague: fast, focused, and built for real investigations or even CTF's.

Learn how this tool understands your forensic workflows, decodes technical jargon, and supports smarter, faster investigations. Clint shares how to start using IRCO, common use cases, how to keep your data safe, and why many in the field are underestimating its capability.

Whether you're writing reports, analyzing logs, or stuck mid-incident, IRCO can give you the 1% edge you need to  solve tricky DFIR investigations and communicate reports more quickly.

🔍 Topics covered:
 – What is IRCO?
 – How to integrate AI into digital forensics workflows
 – Using  IRCO  for live incidents, CTFs, and training
 – Privacy and responsible AI use in SOC environments
 – Actionable prompts and use cases

🎧 Subscribe to TLP now and give IRCO a test run. You might just find your new secret weapon in responding to incidents quicker than ever. 

 https://chatgpt.com/g/g-68033ce1b26481919b26df0737241bac-irco-incident-response-co-pilot 

Send us a text

Drawing inspiration from observing military special forces and over five years of hands-on DFIR experience, Clint explores the mindset, habits, and tactical processes that set top-performing IR teams apart. Clint Marsden explores the mindset, habits, and tactical processes that set top-performing IR teams apart.

From threat intelligence workflows and detection-first thinking to deep forensic analysis and clear executive reporting, this episode is packed with real-world lessons, relatable stories, and practical advice. Whether you're running your first threat hunt or leading an enterprise SOC, you'll walk away with a clearer vision for building a resilient, high-performing IR capability.

You’ll learn:

• Why elite IR teams focus on boring repetition and clarity over cool tools
• How to track threat groups and adapt detection rules in real time
• Where most SOCs fail with SIEM tuning and memory forensics
• How to communicate findings that actually move leadership to act

Check out the blog: www.dfirinsights.com

Send us a text

Clint Marsden breaks down a critical cybersecurity report from intelligence agencies including the CSA, NSA, and FBI about the growing threat of AI data poisoning. Learn how malicious actors can hijack AI systems for as little as $60, turning machine learning models against their intended purpose by corrupting training data.

Clint explains the technical concept of data poisoning in accessible terms, comparing it to teaching a child the wrong labels for objects. He walks through the six-stage framework where AI systems become vulnerable, from initial design to production deployment, and covers the ten security recommendations intelligence agencies are now promoting to defend against these attacks.

The episode explores real-world examples of AI systems gone wrong, from shopping bots buying drugs on the dark web to coordinated attacks by online communities. You'll discover practical mitigation strategies including cryptographic verification, secure data storage, anomaly detection, and the importance of "human in the loop" safeguards.

Whether you're a cybersecurity professional, AI developer, or simply curious about emerging digital threats, this episode provides essential insights into protecting AI systems from manipulation and understanding why data integrity has become a national security concern.

Key Topics Covered:

• Split view poisoning and expired domain attacks
• Data sanitization and anomaly detection techniques
• Zero trust principles for AI infrastructure
• The role of adversarial machine learning in cybersecurity
• Why defenders must learn AI as quickly as attackers
  
  The PDF from CISA etc al: https://www.ic3.gov/CSA/2025/250522.pdf

Send us a text

This episode features the complete narration of my ebook: Mastering Sysmon – Deploying, Configuring, and Tuning in 10 Easy Steps, providing a step-by-step guide to getting Sysmon up and running for better threat detection and incident response.

If you’re in security operations, digital forensics, or incident response, this episode will help you:

• Deploy Sysmon efficiently.
• Tune Sysmon logs for maximum insight while reducing noise.
• Use Sysmon for investigations—from process creation tracking to network monitoring.
• Understand real-world use cases of how Sysmon can catch adversaries in action.

Key Topics Covered:

• Why Sysmon Matters – A deep dive into how Sysmon enhances Windows logging.
• Common Mistakes & How to Avoid Them – Logging misconfigurations, tuning issues, and evidence handling best practices.
• Step-by-Step Deployment Guide – From downloading Sysmon to configuring it for lean detections.
• Tuning for Performance & Relevance – How to tweak Sysmon settings to avoid excessive log volume.
• Investigating Security Events – Key Sysmon event IDs that provide forensic gold.
• Real-World Use Cases – Examples of how Sysmon has caught attackers in action.
• Sysmon Bypass Techniques – How adversaries evade detection and how to stay ahead.

Resources Mentioned:

1. Sysmon Download – Microsoft Sysinternals
2. Sysmon Configuration Files – Olaf Hartong’s Sysmon-Modular
3. MITRE ATT&CK Framework – MITRE ATT&CK
4. ACSC Sysmon Config Guide – ACSC GitHub

Key Takeaways:

• Sysmon provides deep system visibility – if tuned correctly.
•  Tuning is essential – Avoid log overload while keeping useful data.
•  Use a structured deployment process – From baselining performance to verifying logs.
•  Sysmon alone isn’t enough – It works best when combined with other detection tools.
•  Be aware of bypass techniques – Attackers can disable Sysmon, so defense in depth is key.

Send us a text

Ever wanted to build your own Digital Forensics and Incident Response (DFIR) Capture the Flag (CTF) challenge but weren’t sure where to start? In this episode of Traffic Light Protocol, we share the how-to of CTF builders, making it easy for anyone—no pentesting skills required!

Today's episode includes:

•  Choosing Your CTF Theme – Using MITRE ATT&CK and APT tracking to craft a realistic attack scenario.
• Setting Up the Lab – Spinning up a Windows VM, configuring Sysmon, and enabling forensic logging.
• Running the Attack Simulations – Using Atomic Red Team to generate forensic artifacts.
• Testing & Troubleshooting – Making sure your tests actually work before unleashing them on your team.
• Building an Engaging Story – Crafting a compelling incident narrative that challenges analysts to think like investigators.

Resources mentioned in the podcast:

https://drive.google.com/drive/folders/1vF3y-OlsowjX9LUOi7ywDy8VgcfhWcUX?usp=sharing

Send us a text

Kicking off 2025, we're getting back to basics with something every cyber investigator needs to master—starting an investigation the right way. Too often, investigations get derailed because the right questions weren’t asked at the outset, evidence wasn’t properly handled, or reporting lacked clarity.

In this episode, we cover how to build an investigation plan that keeps you on track, ensures consistency, and leads to better results. We talk about evidence volatility, log retention, structuring reports that make sense to non-technical stakeholders, and how to ask the right questions from the start.

Send us a text

Key Takeaways:

• Introduction to Hayabusa: Hayabusa is an open-source Windows Event Log Analysis Tool used for processing EVTX logs to detect suspicious activities in Windows environments.
• Critical Alerts Detection: The tool is capable of detecting a variety of suspicious activities, including WannaCry ransomware and unauthorized Active Directory replication.
• Efficient Incident Response: Hayabusa is ideal for incident response workflows, enabling teams to quickly triage and analyze Windows logs to detect potential breaches or malicious activity.
• Importance of Informational Alerts: Informational alerts can indicate early reconnaissance phases of attacks and should not be dismissed.
• Hypothesis-Driven Threat Hunting: Build a threat hunting hypothesis using MITRE ATT&CK or industry-specific threat intelligence to narrow the focus of the search.
• Integration with SIEM and TimeSketch: Hayabusa supports integration with security tools like SIEM and can export logs into TimeSketch for further analysis and visualization.
• Open-source and Free: Hayabusa is freely available to the cybersecurity community, making it an essential tool for threat detection without added cost.

Send us a text

In this episode of Traffic Light Protocol, Clint Marsden is joined by Jonathan Thompson, a developer and AI enthusiast currently studying at Macquarie University.

Together, they dive into how artificial intelligence (AI) is transforming the cybersecurity landscape and discuss Jon’s insights into AI’s potential applications in digital forensics, incident response, and everyday IT operations.

The conversation touches on ethical considerations, potential job impacts, and how AI can be harnessed to streamline tasks like log analysis, bug detection, and threat identification.


Daniel Kahneman - Thinking Fast and Slow
https://amzn.to/47Cpfjo

The pyramid of pain by David J Bianco: http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

Send us a text

Episode 13 is another giant episode with a focus on what its like be in the mud working on real life forensic investigations. Jacob and Clint talk about ELK EDR, using Sysmon.

Sandbox Environments: Jacob discusses the creation of a sandbox environment using an ELK stack combined with Sysmon, enabling in-depth malware analysis by capturing and analyzing detailed system activity.

Automation in Investigations: Jacob emphasizes the importance of automating repetitive tasks, such as business email compromise investigations, to streamline processes and improve efficiency.

Pen Testing and Red Teaming: Jacob shares insights into the importance of understanding both offensive (red teaming) and defensive (blue teaming) techniques to better anticipate and mitigate threats.

Practical Learning: Jacob advocates for hands-on experience in digital forensics, highlighting the limitations of theoretical knowledge and the value of real-world application.

Resources Mentioned:

• ELK Stack: Used for creating a detailed sandbox environment for malware analysis. Learn more about ELK Stack here.
• Sysmon: Essential tool for capturing detailed logs on Windows systems. Explore Sysmon here.
• Axiom: A commercial digital forensics tool praised for its comprehensive and reliable results. More about Axiom here.
• Cellebrite: A tool used for mobile device forensics, particularly for logical acquisitions. Discover Cellebrite here.
• Splunk: Utilized for automating the investigation process by analyzing large datasets quickly. More on Splunk here.

Jacob Wilson's LinkedIn: https://www.linkedin.com/in/jacob--wilson/?originalSubdomain=au

Send us a text

Quotes:

• “In the fast-paced world of DFIR, you are a mission critical system. Your job isn’t just to uncover what happened during an incident, but to do so in a way that gets results fast.”
• “Specialists bring expertise that pushes the entire industry forward, while generalists offer versatility and adaptability in the ever-changing landscape of cybersecurity.”
• “The choice between specializing and generalizing doesn’t always need to be a conscious decision. Often, you just fall into one or the other depending on the work you do day to day.”

Resources Mentioned:

• LinkedIn - Follow TLP Podcast: Follow us on Linked in, and share your thoughts on this episode. Follow TLP Podcast on LinkedIn
• B-Sides Brisbane Presentation by Ben Gittins: A shout-out was given to Ben Gittins for his presentation on the topic of generalists vs. specialists at B-Sides Brisbane. More about B-Sides Brisbane
• Volatility - Memory Forensics Tool: Developed by Andrew Case, Volatility is highlighted as an essential tool for memory forensics. Download Volatility

Action Points:

• Reflect on Your Career Path: Consider whether you are currently on the path of specialization or generalization in DFIR. Reflect on how this aligns with your career goals and the needs of your organization.
• Engage with the Community: The host invites listeners to share their thoughts on the specialist vs. generalist debate on LinkedIn. Join the discussion to see how others in the field are navigating their careers.
• Stay Updated: Follow the TLP podcast on LinkedIn for more discussions and updates on digital forensics and incident response topics.