blueteamsec

544 readers
13 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
926
3
Detection-Engineering-Framework: A comprehensive framework for Security Operations Center (SOC) use case development, detection engineering, implementation, and management. (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
927
2
LLMDYara: LLMs-Driven Automated YARA Rules Generation with Explainable File Features and DNAHash (i.blackhat.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
928
6
Securing the supply chain at scale: Starting with 71 important open source projects (github.blog)
submitted 2 months ago by digicat to c/blueteamsec
1 comments fedilink
929
10
Attackers are using legit Microsoft services for phishing (pushsecurity.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
930
2
Curly COMrades: A New Threat Actor Targeting Geopolitical Hotbeds (www.bitdefender.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
931
2
Ransomware Landscape in H1 2025: Statistics and Key Issues (medium.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
932
2
New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises (www.trendmicro.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
933
4
Turning Camera Surveillance on its Axis (claroty.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
934
3
Shedding Light on PoisonSeed’s Phishing Kit (blog.nviso.eu)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
935
3
NTDS.dit Dumping with Shadow Snapshot Method via WMI (No Code Execution) (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
936
2
Extraction of Synology encrypted archives (www.synacktiv.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
937
2
针对Web3&Cryptocurrency领域GitHub项目定向钓鱼检测技术方案 - Targeted Phishing Detection Technology for GitHub Projects in the Web3 & Cryptocurrency Field (mp.weixin.qq.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
938
3
Certify 2.0 - AD CS attack tooling (specterops.io)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
939
3
Heracles Attack - Chosen Plaintext Attack on AMD SEV-SNP (to appear at ACM CCS 2025) (heracles-attack.github.io)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
940
5
Go Get 'Em: Updates to Volexity Golang Tooling (www.volexity.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
941
2
Sanctum: Sanctum is an experimental proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antivirus. Built in Rust. (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
942
2
Justice Department Announces Coordinated Disruption Actions Against BlackSuit (Royal) Ransomware Operations (www.justice.gov)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
943
2
Shade BIOS: Unleashing the Full Stealth of UEFI Malware - proof of concept (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
 
 

Slides - https://blackhat.com/us-25/briefings/schedule/#shade-bios-unleashing-the-full-stealth-of-uefi-malware-45786

944
3
Citrix kwetsbaarheid (Update 11-08-2025) - "forensic analyses of data from the affected organizations, the NCSC has indications that the vulnerabilities in Citrix NetScaler ADC exploited in May" (www-ncsc-nl.translate.goog)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
945
2
Remote-DLL-Injection-with-Timer-based-Shellcode-Execution: Remote DLL Injection with Timer-based Shellcode Execution (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
946
4
Yara-X v1.5: Implement the crx module for parsing Chrome Extension files (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
947
7
APT Down: The North Korea Files (drive.proton.me)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
948
6
RPC-Racer: Toolset to manipulate RPC clients by finding delayed services and masquerading as them (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
949
2
xrefgen: Mandiant XRefer Professional IDAPython script that generates additional cross-references for IDA Pro that aren't automatically detected (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
950
2
Stardust Chollima APT Adversary Simulation (medium.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›