blueteamsec

439 readers

42 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

126

0

How to automatically disable users in AWS Managed Microsoft AD based on GuardDuty findings (aws.amazon.com)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

127

-1

白盒+LLM：京东操作类越权自动化检测实践 - using LLMs to find web vulns by gen'ing AST, generating graphs, function call graph (S)CG, a control flow graph (CFG), a data flow graph (DFG), a combined code property graph (mp.weixin.qq.com)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

128

0

大模型漏洞分析准确度提升的实践分享 - Practical Sharing on Improving the Accuracy of Vulnerability Analysis for Large Models - to triage public CVE to determine RCE - use translate as in Chinese (mp.weixin.qq.com)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

129

0

Run shellcode using LdrCallEnclave - Windows (gist.github.com)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

130

0

FileJacking – Initial Access with File System API - "I observed no MotW bypass during the research. All functions that allowed writing to a file during the first modification immediately added MotW." (print3m.github.io)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

131

3

Why continuous profiling is the fourth pillar of observability (www.datadoghq.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

132

3

Let’s get Digital! Updated Digital Identity Guidelines are Here! NIST (www.nist.gov)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

133

3

Advisory on North Korean information technology (IT) workers - mid-July Canadian government (rcmp.ca)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

134

3

hashcat v7.0.0 (hashcat.net)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

135

3

Dreigingslandschap Vitale Infrastructuur (2025) - Threat Landscape Critical Infrastructure (2025) (www.nctv.nl)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

136

2

The 26th Annual Hawke Lecture: Counting and countering the cost of espionage - "Often it’s a combination of both, where cyber-espionage enables in-person espionage or in-person espionage begets cyber- (www.asio.gov.au)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

137

2

OpenImporter: Middleware utility for enriching and uploading data gathered with arbitrary collectors to more effectively map to existing Bloodhound database objects. (github.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

138

1

Beyond the Patch: SharePoint Exploits and the Hidden Threat of IIS Module Persistence (www.splunk.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

139

1

Hunting for Secrets in Plain Sight: Leveraging Internal Logging and Monitoring Services (www.praetorian.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

140

1

UNC2891 Bank Heist: Physical ATM Backdoor & Linux Forensic Evasion Evasion (www.group-ib.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

141

1

CTO at NCSC Summary: week ending August 3rd (ctoatncsc.substack.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

142

1

#OFTW v3.0 - 'Objective for the We' v3.0 - London, July 2025 - slides and videos (objective-see.org)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

143

8

Plague: A Newly Discovered PAM-Based Backdoor for Linux (www.nextron-systems.com)

submitted 1 week ago by digicat to c/blueteamsec

9 comments fedilink

144

1

From Georgia to Ukraine: Seventeen Years of Russian Cyber Capabilities at War - Modern War Institute (mwi.westpoint.edu)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

145

0

Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities (info.greynoise.io)

submitted 1 week ago* (last edited 1 week ago) by digicat to c/blueteamsec

1 comments fedilink

146

-2

Warren is an open-source security alert management system that automates the tedious parts of alert triage. It ingests alerts from your existing tools, enriches them with AI and threat intelligence (github.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

https://zenn.dev/mizutani/articles/secmon-warren

147

5

Illumina Inc. to Pay $9.8M to Resolve False Claims Act Allegations Arising from Cybersecurity Vulnerabilities in Genomic Sequencing Systems (www.justice.gov)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

148

3

Naming country linked to UNC3886 attack not in Singapore’s best interest at this point in time: Shanmugam (www.channelnewsasia.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

149

4

Exploiting the Synology TC500 at Pwn2Own Ireland 2024 (blog.infosectcbr.com.au)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

150

2

Let’s Be Objective: A Deep Dive into 0bj3ctivityStealer's Features (www.trellix.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink