blueteamsec

545 readers
22 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
701
1
RDP Forensics Part 1: Fingerprinting Attacks with Keyboard Layout Data (medium.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
702
2
APT Sidewinder - "the HuntSQL query to track POST requests to "paknavy[.]org[.]pk" and found 25 Unique Webpages" (pastebin.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
703
2
The Trap of Troubleshooting: Analysis of Lazarus (APT-Q-1)'s Recent Attacks Using ClickFix (mp.weixin.qq.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
704
2
Ransomware Damage Recovery｜National Police Agency - Phobos/8Base Decryption Tool (www.npa.go.jp)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
705
4
Security incident post-mortem - "resulted in $14 million in unauthorized withdrawals from 9 user accounts.this attack was perpetrated by UNC4899, a North Korean state-sponsored actor" (woox.io)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
706
2
Operation HanKook Phantom: APT37 Spear-Phishing Campaign (www.seqrite.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
707
3
Founding: Founding is a generator that will create a loader encrypted or obfuscated with different execution types (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
708
11
Copilot Broke Your Audit Log, but Microsoft Won’t Tell You (pistachioapp.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
709
2
Using Auth0 Logs for Proactive Threat Detection (sec.okta.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
710
3
Backdoor in "AppSuite PDF Editor": A Detailed Technical Analysis (www.gdatasoftware.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
711
8
Canary tokens: Learn all about the unsung heroes of security at Grafana Labs (grafana.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
712
4
Uncovering Compromised Hosts using SSH Public Keys (www.usenix.org)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
713
3
Advisory - Netskope Client for Windows - Local Privilege Escalation via Rogue Server (CVE-2025-0309) (blog.amberwolf.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
714
7
Citrix forgot to tell you CVE-2025–6543 has been used as a zero day since May 2025 (doublepulsar.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
715
3
CTO at NCSC Summary: week ending August 31st (ctoatncsc.substack.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
716
0
PoolFlip: A Multi-Agent Reinforcement Learning Security Environment for Cyber Defense (arxiv.org)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
717
1
Chasing the Silver Fox: Cat & Mouse in Kernel Shadows (research.checkpoint.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
718
2
Methodology for Characterizing Network Behavior of Internet of Things Devices (www.nist.gov)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
719
8
WhatsApp - "could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability .. may have been exploited" (www.whatsapp.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
720
5
Iran-Nexus Spear phishing Campaign Masquerades as Omani MFA to Target Global Governments (dreamgroup.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
721
2
Cache Me If You Can (Sitecore Experience Platform Cache Poisoning to RCE) (labs.watchtowr.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
722
3
Amazon disrupts watering hole campaign by Russia’s APT29 | Amazon Web Services (aws.amazon.com)
submitted 2 months ago* (last edited 2 months ago) by digicat to c/blueteamsec
1 comments fedilink
723
3
Detecting Velociraptor misuse :: Velociraptor (docs.velociraptor.app)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
724
4
A Nightmare on EDR Street: WDAC's Revenge (beierle.win)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
725
7
ShadowSilk: A Cross-Border Binary Union for Data Exfiltration (www.group-ib.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›