blueteamsec

427 readers

26 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

51

3

A fresh look for the Microsoft authentication background - Microsoft changing the background on authentication screens - may cause phishing reporting.. (techcommunity.microsoft.com)

submitted 3 days ago by digicat to c/blueteamsec

0 comments fedilink

52

1

Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations (research.checkpoint.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

53

-2

Warren is an open-source security alert management system that automates the tedious parts of alert triage. It ingests alerts from your existing tools, enriches them with AI and threat intelligence (github.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

https://zenn.dev/mizutani/articles/secmon-warren

54

1

What Comes After Detection Rules? Smarter Detection Strategies in ATT&CK (medium.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

55

1

Using LLMs as a reverse engineering sidekick (blog.talosintelligence.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

56

1

Email-Delivered RMM: Abusing PDFs for Silent Initial Access (labs.withsecure.com)

submitted 3 days ago by digicat to c/blueteamsec

0 comments fedilink

57

1

How North Korea-Backed Lazarus Group Is Weaponizing Open Source to Target Developers (www.sonatype.com)

submitted 3 days ago by digicat to c/blueteamsec

0 comments fedilink

58

2

Extending AD CS attack surface to the cloud with Intune certificates - "means going from regular user and their endpoint to Domain Admin in AD, all from the cloud. This blog explores the scenarios" (dirkjanm.io)

submitted 3 days ago by digicat to c/blueteamsec

0 comments fedilink

59

2

Closing the Execution Gap: Hardware-Backed Telemetry for Detecting Out-Of-Context Execution (info.preludesecurity.com)

submitted 3 days ago by digicat to c/blueteamsec

0 comments fedilink

60

2

Clorox versus Cognizant Complaint - Cognizant’sconduct on August 11, 2023, demonstrated spectacularly that it was failing to do so. Cognizantrepeatedly gave a cybercriminal access to Clorox’s network (www.documentcloud.org)

submitted 3 days ago by digicat to c/blueteamsec

1 comments fedilink

61

10

Microsoft Used China-Based Support for Multiple U.S. Agencies, Potentially Exposing Sensitive Data (www.propublica.org)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

62

1

Node-SAML SAML Signature Verification Vulnerability - "Node-SAML loads the assertion from the (unsigned) original response document...is different than the parts that are verified when checking sig" (github.com)

submitted 3 days ago by digicat to c/blueteamsec

0 comments fedilink

63

5

Spear Phishing Campaign Delivers VIP Keylogger via Email Attachment - AutoIt script is utilized to deliver and execute the malicious payload. (www.seqrite.com)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

64

5

Governor Walz Activates Minnesota National Guard Following Saint Paul Cyberattack (mn.gov)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

65

0

Introducing Unit 42’s Attribution Framework (unit42.paloaltonetworks.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

66

3

APT28’s New Arsenal: LAMEHUG, the First AI-Powered Malware - previously reported by the Ukrainian CERT (www.logpoint.com)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

67

3

Mimo gang weaponizes religious symbols to deliver 4L4MD4r ransomware using Microsoft SharePoint RCE vulnerability - reporting from China (mp-weixin-qq-com.translate.goog)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

68

4

Telemetry and Privacy Analysis of Trae IDE: A Deep Dive into ByteDance's VSCode Fork (github.com)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

69

4

RansomFS: an example of using canary files and directories, chained with different threshold engines to map a PID to its malicious behaviour and trigger a response when this threshold is breached. (github.com)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

70

4

PyPI Users Email Phishing Attack - The Python Package Index Blog (blog.pypi.org)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

71

6

Is AWS Recycling your Access Keys? (www.hunters.security)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

72

6

theProtector: Linux Bash Script for the Paranoid Admin on a Budget - real-time monitoring and active threat response (github.com)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

73

6

Hackers Destroy Aeroflot’s IT Infrastructure, Causing Over 42 Flight Cancellations - "destroyed around 7,000 physical and virtual servers, exfiltrated over 22 terabytes of data" (militarnyi.com)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

74

6

ToolShell: a story of five vulnerabilities in Microsoft SharePoint (securelist.com)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

75

1

LOLRMM is a curated list of Remote Monitoring and Management (RMM) - now with SIEM detections - see comment for important PR for KQL (lolrmm.io)

submitted 3 days ago* (last edited 3 days ago) by digicat to c/blueteamsec

1 comments fedilink