blueteamsec

456 readers

26 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

326

6

Hackers Destroy Aeroflot’s IT Infrastructure, Causing Over 42 Flight Cancellations - "destroyed around 7,000 physical and virtual servers, exfiltrated over 22 terabytes of data" (militarnyi.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

327

3

RuleSetRAT: A curated collection of YARA rules and structured JSON reports designed to identify and analyze various malware builder variants, for educational and research purposes only. (github.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

328

2

EXEfromCER: PoC that downloads an executable from a public SSL certificate (github.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

329

2

WorkloadIdentityInfoXdr: Function to get summarized overview of application and workload identities from IdentityInfo and OAuthAppInfo table with API Permissions, Azure RBAC- and Entra ID roles etc. (github.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

330

4

Taming the Windows Module Loading for Stealthy Injection (youtu.be)

submitted 2 weeks ago by digicat to c/blueteamsec

1 comments fedilink

331

1

LOTS-Project-Rework: This folder acts as a "rework" of the original LOTS (Living Off Trusted Sites) Project - The LOTS-Project website never had a CSV and/or JSON (github.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

332

1

ysonet: Deserialization payload generator for a variety of .NET formatters - YSoNet is a fork and replacement of YSoSerial .Net - incs ysonet.exe -p sharepoint --cve=CVE-2025-49704 -var 2 -c "C:\temp (github.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

333

1

The Evolution of Threat Hunting: From IOC Whack-a-Mole to Hypothesis-Driven Sleuthing (medium.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

334

1

TAG Bulletin: Q2 2025 (blog.google)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

335

1

Fake Zoom Call Lures for Zoom Workplace Credentials (cofense.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

336

1

Malware in Panda Image Hides Persistent Linux Threat - "This technique isn’t steganography but rather polyglot file abuse or malicious file embedding. " - ignore the AI (www.aquasec.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

337

1

DFIR-IRIS: developed by Airbus CERT (France), is an open source solution designed to efficiently manage the entire incident response chain. (github.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

338

1

Ghosting the Sensor: Disrupting Defender for Identity Without Detection (cyberdom.blog)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

339

1

Detecting ADCS Privilege Escalation (www.blackhillsinfosec.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

340

1

Shutting the Door on Vishing-Driven Data Theft in Salesforce - "UNC6040’s phone-phishers lure employees into approving a fake dataloader[.]io app, hijacking Salesforce APIs to siphon customer data." (appomni.com)

submitted 2 weeks ago by digicat to c/blueteamsec

2 comments fedilink

341

1

Tracing Bugs Across Kernels: SMB Vulnerabilities in macOS and FreeBSD (github.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

342

1

SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers - "first observed ToolShell exploitation on July 17th, ahead of official Microsoft advisories." (www.sentinelone.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

343

1

Allianz Life says majority of customers' data stolen in hack (archive.ph)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

344

1

NCSC and CERT NZ integration now complete (www.ncsc.govt.nz)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

345

1

Webshell Detection Script for Citrix Netscaler appliances - TLPCLEAR_check_script_cve-2025-6543-v1.7.sh (github.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

346

1

Modular PIC C2 Agents - "This makes it possible (at least in theory) to write a C2 agent that is made up of multiple individual PICOs, rather than a singular monolithic DLL or PIC code base" (rastamouse.me)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

347

1

Killer-Exercice: An Exercice for Red Team to Reverse & Exploit, that's a valid BYOVD Killer, not HVCI Blocklisted, and not in LOLBIN (github.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

348

1

RAIWhateverTrigger: Local SYSTEM auth trigger for relaying - based on the original RAITrigger technique that abuses the RAiForceElevationPromptForCOM RPC function in appinfo.dll to trigger SYSTEM auth (github.com)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

349

1

Escaping the Confines of Port 445 - "TL;DR NTLM relay attacks on SMB restrict lateral movement to port 445/TCP capabilities. To extend beyond, leverage the Service Control Manager (SCM) remotely" (specterops.io)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink

350

1

SRAM Has No Chill: Exploiting Power Domain Separation to Steal On-Chip Secrets (cacm.acm.org)

submitted 2 weeks ago by digicat to c/blueteamsec

0 comments fedilink