blueteamsec

675 readers
17 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
1276
0
Find-AdminAccess: This C# tool sprays for admin access over the entire domain (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1277
1
The OID Problem: Writing LDAP Detections That Actually Work (www.huntress.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1278
2
silph: Stealthy In-Memory Local Password Harvester (SILPH) tool: dump LSA, SAM and DCC2 with indirect syscall (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1279
1
RAG, ICL, and Windows Events: Building a Human-Guided Security Analyst (jonny-johnson.medium.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1280
-1
EventSight: AI-powered Windows Event Log analyzer that learns from your feedback. Uses Claude AI with RAG to detect suspicious activity, improve accuracy over time (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1281
0
TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy in the Era of AI Assisted Reverse Engineering (www.evilsocket.net)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1282
2
Using DCOM objects for remote command execution (securelist.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1283
2
Yet Another DCOM Object for Command Execution Part 2 (sud0ru.ghost.io)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1284
1
Making CloudFlare Workers Work for Red Teams (blog.zsec.uk)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1285
2
CTO at NCSC Summary: week ending December 21st - nearly Christmas edition ❄️🎄🎅🤶🎄❄️ (ctoatncsc.substack.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1286
2
APT-C-36（盲眼鹰）利用Hijackloader开展攻击活动 - APT-C-36 (Blind Hawk) uses Hijackloader to carry out attacks. (mp.weixin.qq.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1287
9
Russia is responsible for destructive and disruptive cyberattacks against Denmark (www.fe-ddis.dk)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1288
1
Unmasking the Evolving Iranian Prince of Persia (www.safebreach.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1289
6
Amazon Caught North Korean IT Worker By Tracing Keystroke Data (www.bloomberg.com)
submitted 3 months ago by digicat to c/blueteamsec
1 comments fedilink
1290
2
GachiLoader: Defeating Node.js Malware with API Tracing GachiLoader: Defeating Node.js Malware (research.checkpoint.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1291
2
LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan (www.welivesecurity.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1292
2
Black Hole of Trust: SEO Poisoning in Silver Fox’s Space Odyssey (www.nccgroup.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1293
1
BlueDelta’s Persistent Campaign Against UKR.NET (www.recordedfuture.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1294
2
Inside DPRK Operations: New Lazarus and Kimsuky Infrastructure Uncovered Across Global Campaigns (hunt.io)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1295
2
Understanding MFA Bypass: Trends, Tactics, and Solutions (noorstream.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1296
1
HubSpot users targeted by active phishing campaign (evalian.co.uk)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1297
1
ResidentBat: Operational Report & Advisory on KGB spyware in Belarus in 2025 (resident.ngo)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1298
1
Exclusive: RSF uncovers new spyware from Belarus (rsf.org)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1299
1
React2Shell used as initial access vector for Weaxor ransomware deployment (www.s-rminform.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1300
1
Access granted: phishing with device code authorization for account takeover (www.proofpoint.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›