blueteamsec

630 readers
54 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
1026
1
BOF_RunPe: BOF to run PE in Cobalt Strike Beacon without console creation (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1027
4
Misaligned Opcode Exception Waterfall (MOEW) A Technical Analysis of Exception-Driven SEH Manipulation, Telemetry Evasion, and Kernel-Mediated User-Mode Code Execution (github.com)
submitted 2 months ago by digicat to c/blueteamsec
1 comments fedilink
1028
3
IACR News item: 21 November 2025 - Unfortunately, one of the three trustees has irretrievably lost their private key, and therefore cannot compute their decryption share (www.iacr.org)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1029
5
Unhooking ntdll.dll in Rust: A Beginner-Friendly Guide to Bypassing EDR Hooks (medium.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1030
3
Sliver C2 Insecure Default Network Policy (CVE-2025-27093) (hngnh.com)
submitted 2 months ago* (last edited 2 months ago) by digicat to c/blueteamsec
0 comments fedilink
1031
3
Enhancing visibility into your identity fabric with Microsoft Defender - Account correlation links related accounts and corresponding insights to provide identity-level visibility (techcommunity.microsoft.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1032
3
Native Sysmon functionality coming to Windows (techcommunity.microsoft.com)
submitted 2 months ago by digicat to c/blueteamsec
1 comments fedilink
1033
-5
Start using Windows Autopatch (learn.microsoft.com)
submitted 2 months ago by digicat to c/blueteamsec
1 comments fedilink
1034
2
TelemetryCollectionManager: Manage and maintain Defender XDR custom collection configuration (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1035
3
Active Directory Security: Trusts Stuck on Windows 2000 Attributes (www.tenable.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1036
2
UNC2891:ATM Threats Never Die - How a device small enough to fit in your pocket – a Raspberry Pi – became the key to infiltrating entire ATM networks (www.group-ib.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1037
2
Fortinet published an advisory for CVE-2025-58034. it is an authenticated command injection vulnerability affecting FortiWeb. Fortinet and CISA have indicated that it has been exploited in-the-wild (attackerkb.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1038
3
Creating a YARA Repository (brkalbyrk.github.io)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1039
4
Inside DPRK’s Fake Job Platform Targeting U.S. AI Talent (www.validin.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1040
2
Analysis of attack activities suspected to be deployed by the APT-C-26 (Lazarus) group using remote IT spoofing to deploy surveillance programs (mp.weixin.qq.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1041
2
Client certificate or certificate plus domain authentication - Endpoint Management guidance to address ESC1. They now explicitly instruct admins to revoke the "Enroll" permission from Domain Users. (docs.citrix.com)
submitted 2 months ago* (last edited 2 months ago) by digicat to c/blueteamsec
0 comments fedilink
1042
2
Driver Reversing 101 - Part II: Unpacking a VMProtected Boot Driver (eversinc33.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1043
3
Threat Intelligence Report: APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets (dti.domaintools.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1044
2
CTO at NCSC Summary: week ending November 23rd (ctoatncsc.substack.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1045
4
Operation WrtHug, The Global Espionage Campaign Hiding in Your Home Router (securityscorecard.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1046
5
JA4D and JA4D6: DHCP Fingerprinting (foxio.io)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1047
3
ENISA Sectorial Threat Landscape - Public Administration (www.enisa.europa.eu)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1048
1
Reframing Insights | Chollima Group (chollima-group.io)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1049
1
WSUS 원격 코드 실행 취약점(CVE-2025-59287)을 악용한 ShadowPad 공격 사례 분석 - APT Malware Analysis of a ShadowPad attack exploiting the WSUS remote code execution vulnerability (CVE-2025-59287) (asec.ahnlab.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
1050
1
Microsoft Defender for Endpoint Internal 0x06 — Custom Collection (medium.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›