blueteamsec

630 readers
52 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
1076
3
Nation-State Actor’s Arsenal: An In-Depth Look at Lazarus’ ScoringMathTea (0x0d4y.blog)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1077
4
China’s attribution strategy has changed; it’s time for us to catch up (bindinghook.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1078
0
SigmaおよびYARAルールを活用したリアルタイムクライアント監視ツールYAMAGoya - JPCERT/CC Eyes - YAMAGoya, a real-time client monitoring tool that utilizes Sigma and YARA rules (blogs.jpcert.or.jp)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1079
1
Detailed Analysis of HeadCalls: Impersonation of Korean Public and Financial Institutions (s2w.inc)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1080
1
Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem | Google Cloud Blog (cloud.google.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1081
2
EventBridge Pattern Matching: Complete Guide to Complex Rules (deceptiq.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1082
2
itunesstored & bookassetd sandbox escape - Hana's Blog (hanakim3945.github.io)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1083
3
The Hidden Risks inside ChatGPT in Entra ID (cyberdom.blog)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1084
1
Entra ID Log Analyzer: Turning Raw Logs into Stories (cyberdom.blog)
submitted 3 months ago* (last edited 3 months ago) by digicat to c/blueteamsec
0 comments fedilink
1085
2
Update: Implementation Guidance for Emergency Directive on Cisco ASA and Firepower Device Vulnerabilities (www.cisa.gov)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1086
3
Israel National Digital Agency researchers have uncovered an ongoing, sophisticated espionage campaign by SpearSpecter, conducted by Iranian threat actors (govextra.gov.il)
submitted 3 months ago by digicat to c/blueteamsec
1 comments fedilink
1087
1
Be KVM, Do Fraud - discovering KVMs (blog.grumpygoose.io)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1088
2
Saeros: Open source HIDS tailored for Microsoft Active Directory and Workstations (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1089
1
SAMDump: Extracts SAM and SYSTEM using Volume Shadow Copy (VSS) API with multiple exfiltration options and XOR obfuscation (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1090
2
GhostX Platform – Offensive Security Module Version: 1.0 (Internal Training – Military & Public Security Use) - Knownsec 404 Team / GhostX R&D - AI generated from the leaks (0x0.st)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
 
 

src: https://x.com/hackerfantastic/status/1988682933503430879

1091
2
CTO at NCSC Summary: week ending November 16th (ctoatncsc.substack.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1092
1
UNC5174 Windows Malware Snowlight (sect.iij.ad.jp)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1093
1
Ryūjin - Writing a Bin2Bin Obfuscator from Scratch for Windows PE x64 and Fully Deobfuscating It (keowu.re)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1094
9
Amazon Inspector detects over 150,000 malicious packages linked to token farming campaign (aws.amazon.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1095
0
Leveraging Large Models to Assist Automated BYOVD-Driven Vulnerability Discovery (mp.weixin.qq.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1096
2
git-fsmonitor: This is a proof-of-work for abusing "fsmonitor" against IDE. (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1097
1
Rehabilitating Registry Tradecraft with RegRestoreKey (www.preludesecurity.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1098
1
ZeroCrumb: Dumping App Bound Protected Credentials & Cookies Without Privileges. (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1099
1
flowsint: A modern platform for visual, flexible, and extensible graph-based investigations. For cybersecurity analysts and investigators. (github.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
1100
1
When The Impersonation Function Gets Used To Impersonate Users (Fortinet FortiWeb Auth. Bypass CVE-2025-64446) (labs.watchtowr.com)
submitted 3 months ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›