blueteamsec

679 readers

32 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

1501

2

commandline_spoofing: Commandline spoofing on Windows (github.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1502

1

RelayInformer: Python and BOF utilites to the determine EPA enforcement levels of popular NTLM relay targets from the offensive perspective (github.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1503

1

Anti-Sandbox: Detecting AnyRun sandbox, and more is coming out in the future - AnyRun being Russian in origin (github.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1504

1

GitHub - mimorep/Indirect-Shellcode-Executor: Indirect-Shellcode-Executor expoits the miss-configuration/vulnerability present on the API Windows method ReadProcessMemory (github.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1505

6

Living Off the Land: Windows Post-Exploitation Without Tools (xbz0n.sh)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1506

1

Neo: The NeoC2 Framework (github.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1507

3

Cracking the Crystal Palace - "To target Crystal Palace artefacts specifically, I only looked at the "stuff" that it inserts into the final assembly, rather than any code that can be written" (rastamouse.me)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1508

1

Cracking the Crystal Palace - "To target Crystal Palace artefacts specifically, I only looked at the "stuff" that it inserts into the final assembly, rather than any code that can be written" (rastamouse.me)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1509

1

MANTIS: A Deep Dive Into IRIS C2's Flagship Windows Agent (www.irisc2.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1510

1

The most advanced ClickFix yet? - "where the delivery vector was observed, 4 in 5 were accessed via Google Search." (pushsecurity.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1511

4

Phishing for AWS Credentials via the New ‘aws login’ Flow (medium.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1512

2

Analyzing the latest Sneaky2FA BITB phishing page (pushsecurity.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1513

1

Inside Valkyrie Stealer: Capabilities, Evasion Techniques, and Operator Profile (www.dexpose.io)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1514

1

CVE-2025-13315, CVE-2025-13316: Critical Twonky Server Authentication Bypass (NOT FIXED) (www.rapid7.com)

submitted 4 months ago by digicat to c/blueteamsec

1 comments fedilink

1515

1

[Updated 27 Nov 2025 00:21 UTC] Deep scan for bad NPM packages nested across projects - DFIR for Shai-Hulud cyberattack, Sep-Nov 2025 (gist.github.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1516

2

Apache Druid’s Kerberos authenticator uses a weak fallback secret (github.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1517

1

InfCode: Adversarial Iterative Refinement of Tests and Patches for Reliable Software Issue Resolution (arxiv.org)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1518

1

Albiriox Exposed: A New RAT Mobile Malware Targeting Global Finance and Crypto Wallets (www.cleafy.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1519

1

TangleCrypt: a sophisticated but buggy malware packer (labs.withsecure.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1520

1

Breaking Into a Brother (MFC-J1010DW): Three Security Flaws in a Seemingly Innocent Printer (starlabs.sg)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1521

8

Malicious VS Code Extension Impersonating “Material Icon Theme” Found in Marketplace (www.nextron-systems.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1522

1

Operation Hanoi Thief: Threat Actor targets Vietnamese IT professionals and recruitment teams. (www.seqrite.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1523

1

LUMEN: Your Browser-based EVTX Companion (github.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1524

2

Extending Kernel Race Windows Using '/dev/shm' (faith2dxy.xyz)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1525

1

PIVOTcon 2026 Call for Papers (pretalx.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink