blueteamsec

544 readers
22 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
751
3
TAG-144’s Persistent Grip on South American Organizations (www.recordedfuture.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
752
3
Zip Slip: 압축 해제 과정에서 발생하는 Path Traversal 취약점 - Zip Slip: Path Traversal Vulnerability Occurring During the Decompression Process (asec.ahnlab.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
753
4
Multiple vulnerabilities have been discovered in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). (support.citrix.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
754
2
Inline Style Exfiltration: leaking data with chained CSS conditionals (portswigger.net)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
755
4
AI-powered ransomware named PromptLock - uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts on the fly (threadreaderapp.com)
submitted 2 months ago by digicat to c/blueteamsec
1 comments fedilink
756
4
Automating Detection Documentation and Changelog Generation (blog.nviso.eu)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
757
3
MSIXBuilder: MSIX Building Made Easy for Defenders (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
758
3
ZipLine Phishing Campaign Targets U.S. Manufacturing (research.checkpoint.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
759
3
Belarus-Linked DSLRoot Proxy Network Deploys Hardware in U.S. Residences, Including Military Homes (infrawatch.app)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
760
3
ScreenConnect Super Admin Credential Phishing Campaign Targets IT Leaders (www.mimecast.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
761
3
PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats (cloud.google.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
762
5
Detecting ManualFinder/PDF Editor Malware Campaign with KQL (www.lindensec.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
763
3
Exploring Microsoft Sentinel: Deploying a SOC Lab for Threat Hunting. (vedanttapdiya.medium.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
764
3
LLM4Binary (LLM4Binary) - Reverse Engineering: Decompiling Binary Code with Large Language Models - model continues to be updated latest was June, 2025 which was 6.7b v1.6 - a 6.7 billion-parameter (huggingface.co)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
 
 

https://github.com/albertan017/LLM4Decompile

765
3
Chrome-App-Bound-Encryption-Decryption: Fully decrypt App-Bound Encrypted (ABE) cookies, passwords & payment methods from Chromium-based browsers (Chrome, Brave, Edge) - all in user mode, no admin (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
766
5
Raising security with organization-wide YubiKey (FIDO2) in Entra ID (www.huntandhackett.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
767
5
How Token Protection Enhances Conditional Access Policies - Entra - Token Protection is a Conditional Access session control that attempts to reduce token replay attacks by ensuring only device bound (learn.microsoft.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
768
3
What’s new in Microsoft Intune: May 2025 - "we're allowing organizations to set up access policies that will require approval from another administrator before taking remote actions like retire/wipe" (techcommunity.microsoft.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
769
3
XDRStoryParser: Visualize Microsoft Defender XDR process trees and security events (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
770
4
KQL: ExternalData - Cert Central, CertReport - "If this returns TRUE, it means that the cert has been reported in CertReport and therefore, there are high chances that this file is malicious." (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
771
3
mssqlkaren: modified mssqlclient from impacket to extract policies from the SCCM database (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
772
4
rustdllproxy: Crate for generating and hooking into proxy DLLs with Rust. (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
773
2
Profiling Sea Turtle: Tactics, History & Defenses - "Sea Turtle is a Türkiye-nexus threat actor known for conducting state-affiliated espionage operations since at least 2017." (www.invictus-ir.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
774
5
Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery (www.cloudsek.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
775
6
🌀 Fast-Flux DNS: How Malware Uses DNS to Stay Invisible (medium.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›