blueteamsec

633 readers

18 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

2201

1

SQUID-2025:1 Buffer Overflow in URN Handling (github.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2202

1

Quantum networking technologies - "we provide an updated analysis of QKD as a security technology, and the development of QRNGs. We also consider the future of quantum networking technologies." (www.ncsc.gov.uk)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2203

2

EntraGoat - A Deliberately Vulnerable Entra ID Environment (github.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2204

1

Tracing ToneShell: Mustang Panda's Evolving Tradecraft and Campaign Infrastructure (archive.ph)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2205

1

APT36 Targets Indian Infrastructure with Desktop Lures and Poseidon Backdoor (hunt.io)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2206

2

Protecting the Evidence in Real-Time with KQL Queries - "monitoring for attempts to modify the corresponding registry keys can help us generate early alerts and detect potential tampering." (detect.fyi)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2207

1

DHS Launches Over $100 Million in Funding to Strengthen Communities’ Cyber Defenses | CISA (www.cisa.gov)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2208

1

PlayPraetor's evolving threat: How Chinese-speaking actors globally scale an Android RAT (www.cleafy.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2209

0

How to automatically disable users in AWS Managed Microsoft AD based on GuardDuty findings (aws.amazon.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2210

2

Investigating Suspicious Memory Activity: Tracing a SIEM Alert to a Cobalt Strike C2 (daniyyell.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2211

1

Memory Forensics Attack Simulation Dataset - " a curated memory forensics dataset designed to support research, detection engineering, and hands-on training in the fields of malware analysis, incident (daniyyell.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2212

1

암호화폐 거래소로 위장한 페이스북 광고에 의한 악성코드 유포 - Malware spread through Facebook ads disguised as cryptocurrency exchanges. (asec.ahnlab.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2213

1

malefic: IoM implant, C2 Framework and Infrastructure - use seen in the wild (github.com)

submitted 6 months ago by digicat to c/blueteamsec

1 comments fedilink

2214

2

White Paper for Cyberspace Mapping Techniques - from China (www.webray.com.cn)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2215

-1

白盒+LLM：京东操作类越权自动化检测实践 - using LLMs to find web vulns by gen'ing AST, generating graphs, function call graph (S)CG, a control flow graph (CFG), a data flow graph (DFG), a combined code property graph (mp.weixin.qq.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2216

2

The Discriminative Power of Cross-layer RTTs in Fingerprinting Proxy Traffic - NDSS Symposium (www.ndss-symposium.org)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2217

1

CypherBench: Towards Precise Retrieval over Full-scale Modern Knowledge Graphs in the LLM Era - needed to augment those LLMs (arxiv.org)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2218

0

大模型漏洞分析准确度提升的实践分享 - Practical Sharing on Improving the Accuracy of Vulnerability Analysis for Large Models - to triage public CVE to determine RCE - use translate as in Chinese (mp.weixin.qq.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2219

0

Run shellcode using LdrCallEnclave - Windows (gist.github.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2220

0

FileJacking – Initial Access with File System API - "I observed no MotW bypass during the research. All functions that allowed writing to a file during the first modification immediately added MotW." (print3m.github.io)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2221

1

NachoVPN: Now With More VPN (And SYSTEM Shells) - Part 2 - Palo Alto GlobalProtect (blog.amberwolf.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2222

2

Famous Chollima APT Adversary Simulation (medium.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2223

1

Tracking Updates to Raspberry Robin (www.zscaler.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2224

2

RoKRAT Shellcode and Steganographic Threats: Analysis and EDR Response Strategies (www.genians.co.kr)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2225

3

ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago (www.usenix.org)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink