blueteamsec

628 readers
45 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
501
3
GRU-Linked BlueDelta Evolves Credential Harvesting (www.recordedfuture.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
502
3
Defeating AuraStealer: Practical Deobfuscation Workflows for Modern Infostealers (www.gendigital.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
503
2
malpedia-flossed: FLARE floss applied to all unpacked+dumped samples in Malpedia, pre-processed for further use. (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
504
1
NSB — 國家安全局 National Security Bureau - Analysis on China’s Cyber Threats to Taiwan’s Critical Infrastructure in 2025 (www.nsb.gov.tw)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
505
2
100 Days of YARA 2026: Detects document template injection via the 1Table stream (T1221) (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
506
1
100 Days of YARA 2026: Detects Batavia VBE downloader (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
507
2
100 Days of YARA 2026: Detects Windows PE files where there is a mismatch between the number of PE imports and the ProdIDImport0 tool id count which also indicates the number of PE imports (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
508
2
100 Days of YARA 2026: Detects unique strings in Velociraptor MSI files (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
509
1
A closer look at a BGP anomaly in Venezuela (blog.cloudflare.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
510
4
Phishing actors exploit complex routing and misconfigurations to spoof domains (www.microsoft.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
511
4
The Mac Malware of 2025 👾 (objective-see.org)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
512
1
Office Assistant Supply Chain Attack? Delivery of Mltab Plugin Affects Massive Number of Terminals (ti.qianxin.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
513
3
CNCERT: Risk Warning Regarding the "Black Cat" Gang's Use of Search Engines to Spread Counterfeit Notepad++ Download Remote Control Backdoors (mp.weixin.qq.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
514
2
Analyzing PHALT#BLYX: How Fake BSODs and Trusted Build Tools Are Used to Construct a Malware Infection (www.securonix.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
515
1
100 Days of YARA 2026: Detects Windows PE files with potentially duplicated Rich headers. This is based on the fact that there can only exist unique pairs of ProdIDs and Build numbers. (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
516
2
100 Days of YARA 2026: This YARA rule detects hardcoded strings which are part of Apple code-signing. (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
517
1
100 Days of YARA 2026: Detects packer used with recent Oyster loader and implant. (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
518
1
100 Days of YARA 2026: Detects Windows PE files with where the XOR key is set to invalid values such as all zeros or padding or if there is a DanS marker mismatch with the XOR key (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
519
1
IDontLikeFileLocks: Title is self explaining, well theres few methods we can do to read locked file and play with it... (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
520
2
sigint-hombre: Dynamically generated Suricata rules from real-time threat feeds (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
521
2
【重要】EmEditor ホームページに関する不正リンク（マルウェア）について（続報） – EmEditor (テキストエディタ) - 【Important】 About malicious links (malware) related to the EmEditor homepage (follow-up) (jp.emeditor.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
522
2
DbgNexum: Shellcode injection using the Windows Debugging API (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
523
2
FsquirtCPLPoC: PoC for generating bthprops.cpl module designed to be loaded by Fsquirt.exe LOLBin (github.com)
submitted 1 month ago by digicat to c/blueteamsec
1 comments fedilink
524
2
DiaSymbolView: PDB file inspection tool (github.com)
submitted 1 month ago by digicat to c/blueteamsec
0 comments fedilink
525
6
Using ADCS to Attack HTTPS-Enabled WSUS Clients (blog.digitrace.de)
submitted 1 month ago by digicat to c/blueteamsec
1 comments fedilink
view more: ‹ prev next ›