blueteamsec

680 readers
28 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
2476
4
Detecting and countering misuse of AI - "We identified and investigated a sophisticated Chinese threat actor who systematically leveraged Claude to enhancecyber operations targeting Vietnam" (www.anthropic.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2477
10
BruteForceAI: Advanced LLM-powered brute-force tool combining AI intelligence with automated login attacks (github.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2478
4
Widespread Data Theft Targets Salesforce Instances via Salesloft Drift | Google Cloud Blog (cloud.google.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2479
3
TAG-144’s Persistent Grip on South American Organizations (www.recordedfuture.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2480
3
Zip Slip: 압축 해제 과정에서 발생하는 Path Traversal 취약점 - Zip Slip: Path Traversal Vulnerability Occurring During the Decompression Process (asec.ahnlab.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2481
4
Multiple vulnerabilities have been discovered in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). (support.citrix.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2482
2
Inline Style Exfiltration: leaking data with chained CSS conditionals (portswigger.net)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2483
4
AI-powered ransomware named PromptLock - uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts on the fly (threadreaderapp.com)
submitted 7 months ago by digicat to c/blueteamsec
1 comments fedilink
2484
4
Automating Detection Documentation and Changelog Generation (blog.nviso.eu)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2485
3
MSIXBuilder: MSIX Building Made Easy for Defenders (github.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2486
3
ZipLine Phishing Campaign Targets U.S. Manufacturing (research.checkpoint.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2487
3
Belarus-Linked DSLRoot Proxy Network Deploys Hardware in U.S. Residences, Including Military Homes (infrawatch.app)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2488
3
ScreenConnect Super Admin Credential Phishing Campaign Targets IT Leaders (www.mimecast.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2489
3
PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats (cloud.google.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2490
5
Detecting ManualFinder/PDF Editor Malware Campaign with KQL (www.lindensec.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2491
3
Exploring Microsoft Sentinel: Deploying a SOC Lab for Threat Hunting. (vedanttapdiya.medium.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2492
3
LLM4Binary (LLM4Binary) - Reverse Engineering: Decompiling Binary Code with Large Language Models - model continues to be updated latest was June, 2025 which was 6.7b v1.6 - a 6.7 billion-parameter (huggingface.co)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
 
 

https://github.com/albertan017/LLM4Decompile

2493
4
Chrome-App-Bound-Encryption-Decryption: Fully decrypt App-Bound Encrypted (ABE) cookies, passwords & payment methods from Chromium-based browsers (Chrome, Brave, Edge) - all in user mode, no admin (github.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2494
5
Raising security with organization-wide YubiKey (FIDO2) in Entra ID (www.huntandhackett.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2495
5
How Token Protection Enhances Conditional Access Policies - Entra - Token Protection is a Conditional Access session control that attempts to reduce token replay attacks by ensuring only device bound (learn.microsoft.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2496
3
What’s new in Microsoft Intune: May 2025 - "we're allowing organizations to set up access policies that will require approval from another administrator before taking remote actions like retire/wipe" (techcommunity.microsoft.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2497
3
XDRStoryParser: Visualize Microsoft Defender XDR process trees and security events (github.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2498
4
KQL: ExternalData - Cert Central, CertReport - "If this returns TRUE, it means that the cert has been reported in CertReport and therefore, there are high chances that this file is malicious." (github.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2499
3
mssqlkaren: modified mssqlclient from impacket to extract policies from the SCCM database (github.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
2500
4
rustdllproxy: Crate for generating and hooking into proxy DLLs with Rust. (github.com)
submitted 7 months ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›