blueteamsec

632 readers
3 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
1851
1
RDP Forensics Part 2: Fingerprinting Attacks with Timezone, OS Type, and Monitor Display Resolution (medium.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1852
1
RDP Forensics Part 1: Fingerprinting Attacks with Keyboard Layout Data (medium.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1853
2
APT Sidewinder - "the HuntSQL query to track POST requests to "paknavy[.]org[.]pk" and found 25 Unique Webpages" (pastebin.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1854
2
The Trap of Troubleshooting: Analysis of Lazarus (APT-Q-1)'s Recent Attacks Using ClickFix (mp.weixin.qq.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1855
2
Ransomware Damage Recovery｜National Police Agency - Phobos/8Base Decryption Tool (www.npa.go.jp)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1856
4
Security incident post-mortem - "resulted in $14 million in unauthorized withdrawals from 9 user accounts.this attack was perpetrated by UNC4899, a North Korean state-sponsored actor" (woox.io)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1857
2
Operation HanKook Phantom: APT37 Spear-Phishing Campaign (www.seqrite.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1858
3
Founding: Founding is a generator that will create a loader encrypted or obfuscated with different execution types (github.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1859
11
Copilot Broke Your Audit Log, but Microsoft Won’t Tell You (pistachioapp.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1860
2
Using Auth0 Logs for Proactive Threat Detection (sec.okta.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1861
3
Backdoor in "AppSuite PDF Editor": A Detailed Technical Analysis (www.gdatasoftware.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1862
8
Canary tokens: Learn all about the unsung heroes of security at Grafana Labs (grafana.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1863
4
Uncovering Compromised Hosts using SSH Public Keys (www.usenix.org)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1864
3
Advisory - Netskope Client for Windows - Local Privilege Escalation via Rogue Server (CVE-2025-0309) (blog.amberwolf.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1865
7
Citrix forgot to tell you CVE-2025–6543 has been used as a zero day since May 2025 (doublepulsar.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1866
3
CTO at NCSC Summary: week ending August 31st (ctoatncsc.substack.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1867
0
PoolFlip: A Multi-Agent Reinforcement Learning Security Environment for Cyber Defense (arxiv.org)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1868
1
Chasing the Silver Fox: Cat & Mouse in Kernel Shadows (research.checkpoint.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1869
2
Methodology for Characterizing Network Behavior of Internet of Things Devices (www.nist.gov)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1870
8
WhatsApp - "could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability .. may have been exploited" (www.whatsapp.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1871
5
Iran-Nexus Spear phishing Campaign Masquerades as Omani MFA to Target Global Governments (dreamgroup.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1872
2
Cache Me If You Can (Sitecore Experience Platform Cache Poisoning to RCE) (labs.watchtowr.com)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1873
3
Amazon disrupts watering hole campaign by Russia’s APT29 | Amazon Web Services (aws.amazon.com)
submitted 5 months ago* (last edited 5 months ago) by digicat to c/blueteamsec
1 comments fedilink
1874
3
Detecting Velociraptor misuse :: Velociraptor (docs.velociraptor.app)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
1875
4
A Nightmare on EDR Street: WDAC's Revenge (beierle.win)
submitted 5 months ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›