blueteamsec

627 readers
34 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
501
2
100 Days of YARA 2026: Detects Windows PE files where there is a mismatch between the number of PE imports and the ProdIDImport0 tool id count which also indicates the number of PE imports (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
502
2
100 Days of YARA 2026: Detects unique strings in Velociraptor MSI files (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
503
1
A closer look at a BGP anomaly in Venezuela (blog.cloudflare.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
504
4
Phishing actors exploit complex routing and misconfigurations to spoof domains (www.microsoft.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
505
4
The Mac Malware of 2025 👾 (objective-see.org)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
506
1
Office Assistant Supply Chain Attack? Delivery of Mltab Plugin Affects Massive Number of Terminals (ti.qianxin.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
507
3
CNCERT: Risk Warning Regarding the "Black Cat" Gang's Use of Search Engines to Spread Counterfeit Notepad++ Download Remote Control Backdoors (mp.weixin.qq.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
508
2
Analyzing PHALT#BLYX: How Fake BSODs and Trusted Build Tools Are Used to Construct a Malware Infection (www.securonix.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
509
1
100 Days of YARA 2026: Detects Windows PE files with potentially duplicated Rich headers. This is based on the fact that there can only exist unique pairs of ProdIDs and Build numbers. (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
510
2
100 Days of YARA 2026: This YARA rule detects hardcoded strings which are part of Apple code-signing. (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
511
1
100 Days of YARA 2026: Detects packer used with recent Oyster loader and implant. (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
512
1
100 Days of YARA 2026: Detects Windows PE files with where the XOR key is set to invalid values such as all zeros or padding or if there is a DanS marker mismatch with the XOR key (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
513
1
IDontLikeFileLocks: Title is self explaining, well theres few methods we can do to read locked file and play with it... (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
514
2
sigint-hombre: Dynamically generated Suricata rules from real-time threat feeds (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
515
2
【重要】EmEditor ホームページに関する不正リンク（マルウェア）について（続報） – EmEditor (テキストエディタ) - 【Important】 About malicious links (malware) related to the EmEditor homepage (follow-up) (jp.emeditor.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
516
2
DbgNexum: Shellcode injection using the Windows Debugging API (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
517
2
FsquirtCPLPoC: PoC for generating bthprops.cpl module designed to be loaded by Fsquirt.exe LOLBin (github.com)
submitted 1 month ago by digicat to c/blueteamsec
1 comments fedilink
518
2
DiaSymbolView: PDB file inspection tool (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
519
6
Using ADCS to Attack HTTPS-Enabled WSUS Clients (blog.digitrace.de)
submitted 1 month ago by digicat to c/blueteamsec
1 comments fedilink
520
2
More than 50% of Qilin’s "Victims" Never Get Leaked, and I Think That’s an Affiliate Verification Problem (telegra.ph)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
521
2
NGSOTI: Building an Integrated Threat-Intelligence and Information Sharing Ecosystem for the Next Generation of SOC Analysts (www.misp-project.org)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
522
33
witr: Why is this running? - Linux - It explains where a running thing came from, how it was started, and what chain of systems is responsible for it existing right now, in a single, human-readable (github.com)
submitted 1 month ago by digicat to c/blueteamsec
6 comments fedilink
523
3
EntraAzureRBACCheck: Azure RBAC Role Assignment Audit & Drift Detection Tool (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
524
2
BOF Cocktails: implementation pattern for applying evasion tradecraft to BOFs, without relying on hook propagation from a parent implant. (rastamouse.me)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
525
7
rootkit-detection-ebpf-time-trace: Detection of rootkit file hiding activities through analysis of shifts in kernel function execution times. (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›