blueteamsec

675 readers

27 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

1226

1

State-sponsored hacking group LNK malware threat analysis intelligence report (FSI Intelligence Report) (www.fsec.or.kr)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1227

1

Remote Code Execution via Expression Injection - An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1228

3

PQC-Scanner: A PQC network scanner to search for certificates which has been compiled into a exe to run on Windows as well as a Python Script. Essentially a quantum vulnerability assessment tool (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1229

1

List all Intune remediation scripts containing a specific string in detection or remediation (www.systanddeploy.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1230

2

Configure Azure file shares for Entra joined Windows devices and cloud identities (inthecloud247.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1231

4

All about Microsoft Intune | Starting with admin tasks in Microsoft Intune (petervanderwoude.nl)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1232

2

Azure Workbooks data sources - Azure Monitor - Workbooks now have support for querying from Azure Data Explorer clusters with the powerful Kusto query language (learn.microsoft.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1233

2

Code Orange: Fail Small — our resilience plan following recent incidents (blog.cloudflare.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1234

1

Insider Threat Detection Using GCN and Bi-LSTM with Explicit and Implicit Graph Representations (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

https://ieeexplore.ieee.org/document/11311570

1235

1

open-klara: Open KLara Project - a community-driven fork of the original KLara project by Kaspersky Lab, aimed at helping Threat Intelligence researchers hunt for new malware using Yara. (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1236

3

VectoredOverloading in Rust -This is an PoC of implementing that Kidkadi aka VectoredOverloading in Rust. (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1237

1

Announcing hardware-accelerated BitLocker (techcommunity.microsoft.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1238

2

Ukrainian National Pleads Guilty to Conspiracy to Use Nefilim Ransomware to Attack Companies in the United States and Other Countries (www.justice.gov)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1239

1

Advent Of Configuration Extraction – Part 4: Turning capa Into A Configuration Extractor For TinyShell variant (blog.sekoia.io)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1240

1

yaraast: A powerful Python library and CLI tool for parsing, analyzing, and manipulating YARA rules through Abstract Syntax Tree (AST) representation - 0.7 release (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1241

1

MacSync Stealer Evolves: From ClickFix to Code-Signed Swift Malware (www.jamf.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1242

3

Cornwall libraries remove Humphrey books over phishing web links (www.bbc.co.uk)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1243

4

DriverFixer0428 macOS Credential Stealer (www.lunchm0n3y.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1244

1

【重要】EmEditor インストーラーのダウンロード導線に関するセキュリティインシデントのお知らせ – EmEditor (テキストエディタ) - ""We regret that we have confirmed that the download on the EmEditor official may have been tampered with by a 3rd party" (jp.emeditor.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1245

4

Protecting Tokens and Assertions from Forgery, Theft, and Misuse (www.cisa.gov)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1246

2

UNG0801: Tracking Threat Clusters obsessed with AV Icon Spoofing targeting Israel | Seqrite (www.seqrite.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1247

2

Kingest0r: Utility tool to ingest CSV files into Kusto (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1248

1

Callback hell: abusing callbacks, tail-calls, and proxy frames to obfuscate the stack (klezvirus.github.io)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1249

2

How are Prefetch created? (y0sh1mitsu.github.io)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1250

2

Operation Artemis: Analysis of HWP-Based DLL Side Loading Attacks (www.genians.co.kr)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink