blueteamsec

679 readers
39 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
1601
1
From Concealment to Exposure: Understanding the Lifecycle and Infrastructure of APT Domains (tillsongalloway.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1602
1
Towards understanding the lifecycle of malicious network infrastructure (repository.gatech.edu)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1603
1
ForgeDAN: An Evolutionary Framework for Jailbreaking Aligned Large Language Models (arxiv.org)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1604
1
Deciphering Multi-Layer Hidden Loads and Analyzing Drive-Level Blinding Countermeasures | Tracking the Tactics and Techniques of the Silver Fox (mp.weixin.qq.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1605
1
BOF_RunPe: BOF to run PE in Cobalt Strike Beacon without console creation (github.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1606
4
Misaligned Opcode Exception Waterfall (MOEW) A Technical Analysis of Exception-Driven SEH Manipulation, Telemetry Evasion, and Kernel-Mediated User-Mode Code Execution (github.com)
submitted 4 months ago by digicat to c/blueteamsec
1 comments fedilink
1607
3
IACR News item: 21 November 2025 - Unfortunately, one of the three trustees has irretrievably lost their private key, and therefore cannot compute their decryption share (www.iacr.org)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1608
5
Unhooking ntdll.dll in Rust: A Beginner-Friendly Guide to Bypassing EDR Hooks (medium.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1609
3
Sliver C2 Insecure Default Network Policy (CVE-2025-27093) (hngnh.com)
submitted 4 months ago* (last edited 4 months ago) by digicat to c/blueteamsec
0 comments fedilink
1610
3
Enhancing visibility into your identity fabric with Microsoft Defender - Account correlation links related accounts and corresponding insights to provide identity-level visibility (techcommunity.microsoft.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1611
3
Native Sysmon functionality coming to Windows (techcommunity.microsoft.com)
submitted 4 months ago by digicat to c/blueteamsec
1 comments fedilink
1612
-5
Start using Windows Autopatch (learn.microsoft.com)
submitted 4 months ago by digicat to c/blueteamsec
1 comments fedilink
1613
2
TelemetryCollectionManager: Manage and maintain Defender XDR custom collection configuration (github.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1614
3
Active Directory Security: Trusts Stuck on Windows 2000 Attributes (www.tenable.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1615
2
UNC2891:ATM Threats Never Die - How a device small enough to fit in your pocket – a Raspberry Pi – became the key to infiltrating entire ATM networks (www.group-ib.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1616
2
Fortinet published an advisory for CVE-2025-58034. it is an authenticated command injection vulnerability affecting FortiWeb. Fortinet and CISA have indicated that it has been exploited in-the-wild (attackerkb.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1617
3
Creating a YARA Repository (brkalbyrk.github.io)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1618
4
Inside DPRK’s Fake Job Platform Targeting U.S. AI Talent (www.validin.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1619
2
Analysis of attack activities suspected to be deployed by the APT-C-26 (Lazarus) group using remote IT spoofing to deploy surveillance programs (mp.weixin.qq.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1620
2
Client certificate or certificate plus domain authentication - Endpoint Management guidance to address ESC1. They now explicitly instruct admins to revoke the "Enroll" permission from Domain Users. (docs.citrix.com)
submitted 4 months ago* (last edited 4 months ago) by digicat to c/blueteamsec
0 comments fedilink
1621
2
Driver Reversing 101 - Part II: Unpacking a VMProtected Boot Driver (eversinc33.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1622
3
Threat Intelligence Report: APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets (dti.domaintools.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1623
2
CTO at NCSC Summary: week ending November 23rd (ctoatncsc.substack.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1624
4
Operation WrtHug, The Global Espionage Campaign Hiding in Your Home Router (securityscorecard.com)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
1625
5
JA4D and JA4D6: DHCP Fingerprinting (foxio.io)
submitted 4 months ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›