blueteamsec

673 readers
36 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
901
2
Mega RMM KQL Query (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
902
4
Iranian MOIS operating from Starlink (infosec.pub)
submitted 2 months ago* (last edited 2 months ago) by digicat to c/blueteamsec
0 comments fedilink
 
 

https://x.com/_CPResearch_/status/2013349461070586054

903
2
Monitor New Actions in Sentinel & Defender XDR (V2) (kqlquery.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
904
11
Pro-Russia hacktivist activity continues to target UK organisations (www.ncsc.gov.uk)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
905
6
What's in the box !? - 'we were able to obtain a set of pen-testing tools from an active pen-tester and security analyst in China' (open.substack.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
906
3
sliver-tor-bridge: Tor transport bridge for Sliver C2 - anonymous command and control (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
907
4
Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents (blog.tenzai.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
908
3
Operation Poseidon: Spear-Phishing Attacks Abusing Google Ads Redirection Mechanisms (www.genians.co.kr)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
909
5
GhostVEH: Registers Vectored Exception Handlers by directly manipulating internal LdrpVectorHandlerList structure instead of calling RtlAddVectoredExceptionHandler. (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
910
4
anamnesis-release: Automatic Exploit Generation with LLMs (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
911
3
Tangled: Open-source offensive security platform for conducting phishing campaigns that weaponizes iCalendar automatic event processing. (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
912
3
IRGC WhatsApp phishing kit (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
913
2
New Remcos Campaign Distributed Through Fake Shipping Document (www.fortinet.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
914
2
TamperedChef serves bad ads, with infostealers as the main course (www.sophos.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
915
2
Gamaredon: Now Downloading via Windows Updates Best Friend "BITS" (blog.synapticsystems.de)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
916
2
VoidLink threat analysis: C2-compiled kernel rootkits | Sysdig (www.sysdig.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
917
2
How threat actors are using self-hosted GitHub Actions runners as backdoors (www.sysdig.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
918
2
ConsentFix: Securing Your Tenant Against OAuth Authorisation Code Theft (sentinel.blog)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
919
3
Leveraging Landlock telemetry for Linux detection engineering (blog.sekoia.io)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
920
2
SHADOW#REACTOR – Text-Only Staging, .NET Reactor, and In-Memory Remcos RAT Deployment (www.securonix.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
921
3
Evolving the Threat Hunter Playbook 🏹: Planning Hunts with Agent Skills 🤖 (blog.openthreatresearch.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
922
3
Browser Extensions Gone Rogue: The Full Scope of the GhostPoster Campaign (layerxsecurity.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
923
2
Planned failure: Gootloader's malformed ZIP actually works perfectly (expel.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
924
2
How to Use Pareto Principle to Fine-Tune Alerts and Reduce False Positives Wisely (detect.fyi)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
925
2
TIFCE: Threat Intelligence Feed Evaluation (+ KQL Detections) (detect.fyi)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›