blueteamsec

543 readers

11 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

digicat

451

That's How Bloody Wolf Abuses WMI for Discovery (www.knowyouradversary.ru)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

452

That's How Adversaries Abuse WMI for Software Discovery (www.knowyouradversary.ru)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

453

-2

That's How Adversaries Modify Registry to Weaken Security (www.knowyouradversary.ru)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

454

GOLD SALEM’s Warlock operation joins busy ransomware landscape (news.sophos.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

455

Blog: Beyond Sandbox Domains: Rendering Untrusted Web Content with SafeContentFrame (bughunters.google.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

456

ByteCaster: Swiss Army Knife for payload encryption, obfuscation, and conversion to byte arrays – all in a single command (14 output formats supported)! ☢️ (github.com)

submitted 1 month ago by digicat to c/blueteamsec

1 comments fedilink

457

‘I Was a Weird Kid’: Jailhouse Confessions of a Teen Hacker (www.bloomberg.com)

submitted 1 month ago by digicat to c/blueteamsec

1 comments fedilink

458

Unmasking Akira: The ransomware tactics you can’t afford to ignore (zensec.co.uk)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

459

NCSC Summary: week ending September 21st (ctoatncsc.substack.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

460

Threat Actor Profile: APT27 (www.dexpose.io)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

461

EarlyExceptionHandling: Implementing an early exception handler for hooking and threadless process injection without relying on VEH or SEH (github.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

462

Microsoft Vulnerable Driver Block Lists in CSV and JSON for SIEM lookups - Microsoft removed the list and started distributing them as JSON - this gets you back to where we were (github.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

463

raw-gadget: USB Raw Gadget — a low-level interface for the Linux USB Gadget subsystem (github.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

464

release-tampering-pocs: Proof of Concepts for malicious maintainers: How to Tamper with Releases built with GitHub Actions Worfklows, presented at fwd:cloudsec Europe 2025 (github.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

465

[0day] From Spotlight to Apple Intelligence (objective-see.org)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

466

Detecting enumeration in AWS (falconforce.nl)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

467

Potential Actor Token Abuse in Entra ID KQL (github.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

468

ShadowLeak: A Zero-Click, Service-Side Attack Exfiltrating Sensitive Data Using ChatGPT’s Deep Research Agent (www.radware.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

469

Using ASPM to Implement Application Runtime Security Observation in Large Securities Firms (mp.weixin.qq.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

470

MPAF: Encrypted Traffic Classification With Multi-Phase Attribute Fingerprint (ieeexplore.ieee.org)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

471

FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography (www.acronis.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

472

More Fun With WMI (specterops.io)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

473

Keeping privacy when running queries: how to obfuscate your KQL results (www.michalos.net)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

474

疑似APT-C-00（海莲花）投递Havoc木马 - Suspected APT-C-00 (OceanLotus) delivering the Havoc Trojan (mp.weixin.qq.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

475

Gamaredon X Turla collab (www.welivesecurity.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink