Episode 15 -Windows event log analysis with Hayabusa. The Sigma-based log analysis tool
TLP - The Digital Forensics Podcast15 Loka 2024

Episode 15 -Windows event log analysis with Hayabusa. The Sigma-based log analysis tool

Send a text

Key Takeaways:

  • Introduction to Hayabusa: Hayabusa is an open-source Windows Event Log Analysis Tool used for processing EVTX logs to detect suspicious activities in Windows environments.
  • Critical Alerts Detection: The tool is capable of detecting a variety of suspicious activities, including WannaCry ransomware and unauthorized Active Directory replication.
  • Efficient Incident Response: Hayabusa is ideal for incident response workflows, enabling teams to quickly triage and analyze Windows logs to detect potential breaches or malicious activity.
  • Importance of Informational Alerts: Informational alerts can indicate early reconnaissance phases of attacks and should not be dismissed.
  • Hypothesis-Driven Threat Hunting: Build a threat hunting hypothesis using MITRE ATT&CK or industry-specific threat intelligence to narrow the focus of the search.
  • Integration with SIEM and TimeSketch: Hayabusa supports integration with security tools like SIEM and can export logs into TimeSketch for further analysis and visualization.
  • Open-source and Free: Hayabusa is freely available to the cybersecurity community, making it an essential tool for threat detection without added cost.

Tämä jakso on lisätty Podme-palveluun avoimen RSS-syötteen kautta eikä se ole Podmen omaa tuotantoa. Siksi jakso saattaa sisältää mainontaa.

Jaksot(25)

Episode 24: Voice AI Under Attack: Hackers Exploit AI Call Agents | Traffic Light Protocol Podcast

Episode 24: Voice AI Under Attack: Hackers Exploit AI Call Agents | Traffic Light Protocol Podcast

Send a textVoice AI is moving fast — but so are the attackers.In this episode of the Traffic Light Protocol Podcast, Clint and Myles break down how scammers are exploiting Voice AI platforms with the ...

16 Syys 202554min

Episode 23:AI Voice Agent Security: Voice AI Under Siege: SIP Spoofing, Cost Drain, and How to Fight Back

Episode 23:AI Voice Agent Security: Voice AI Under Siege: SIP Spoofing, Cost Drain, and How to Fight Back

Send a textIn this episode of Traffic Light Protocol, we kick off our AI series with a hard look at how voice AI agents are being targeted; and how fast small businesses and startups can rack up serio...

5 Syys 202533min

Episode 22:AI Chat Forensics: How to Find, Investigate, and Analyse Evidence from ChatGPT, Claude & Gemini

Episode 22:AI Chat Forensics: How to Find, Investigate, and Analyse Evidence from ChatGPT, Claude & Gemini

Send a textUnlock the secrets behind digital forensic investigations into AI chat platforms like ChatGPT, Claude, and Google's Gemini in this insightful episode. Learn the precise methods for discover...

22 Kesä 202540min

Episode 21: How IRCO is Changing DFIR: The AI Copilot for Real-Time Cyber Investigations

Episode 21: How IRCO is Changing DFIR: The AI Copilot for Real-Time Cyber Investigations

Send a textLink to IRCO- Incident Response Copilot on Chat  GPThttps://chatgpt.com/g/g-68033ce1b26481919b26df0737241bac-irco-incident-response-co-pilotIn this episode of TLP: The Digital Forensics Pod...

10 Kesä 202515min

Episode 20:What Makes an Elite Incident Response Team: Mindset, Mastery, and Real-World DFIR Lessons

Episode 20:What Makes an Elite Incident Response Team: Mindset, Mastery, and Real-World DFIR Lessons

Send a textDrawing inspiration from observing military special forces and over five years of hands-on DFIR experience, Clint explores the mindset, habits, and tactical processes that set top-performin...

4 Kesä 202538min

Episode 19: AI Data Poisoning: How Bad Actors Corrupt Machine Learning Systems for Under $60

Episode 19: AI Data Poisoning: How Bad Actors Corrupt Machine Learning Systems for Under $60

Send a textClint Marsden breaks down a critical cybersecurity report from intelligence agencies including the CSA, NSA, and FBI about the growing threat of AI data poisoning. Learn how malicious actor...

26 Touko 202526min

Audiobook - Mastering Sysmon. Deploying, Configuring, and Tuning in 10 easy steps

Audiobook - Mastering Sysmon. Deploying, Configuring, and Tuning in 10 easy steps

Send a textThis episode features the complete narration of my ebook: Mastering Sysmon – Deploying, Configuring, and Tuning in 10 Easy Steps, providing a step-by-step guide to getting Sysmon up and run...

28 Helmi 202543min

Episode 17 - Building a CTF

Episode 17 - Building a CTF

Send a textSo You Want to Build Your Own DFIR CTF? Ever wanted to build your own Digital Forensics and Incident Response (DFIR) Capture the Flag (CTF) challenge but weren’t sure where to start? In thi...

27 Helmi 202528min