blueteamsec

444 readers

25 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

176

8

Plague: A Newly Discovered PAM-Based Backdoor for Linux (www.nextron-systems.com)

submitted 1 week ago by digicat to c/blueteamsec

9 comments fedilink

177

1

From Georgia to Ukraine: Seventeen Years of Russian Cyber Capabilities at War - Modern War Institute (mwi.westpoint.edu)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

178

0

Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities (info.greynoise.io)

submitted 1 week ago* (last edited 1 week ago) by digicat to c/blueteamsec

1 comments fedilink

179

-2

Warren is an open-source security alert management system that automates the tedious parts of alert triage. It ingests alerts from your existing tools, enriches them with AI and threat intelligence (github.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

https://zenn.dev/mizutani/articles/secmon-warren

180

5

Illumina Inc. to Pay $9.8M to Resolve False Claims Act Allegations Arising from Cybersecurity Vulnerabilities in Genomic Sequencing Systems (www.justice.gov)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

181

3

Naming country linked to UNC3886 attack not in Singapore’s best interest at this point in time: Shanmugam (www.channelnewsasia.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

182

4

Exploiting the Synology TC500 at Pwn2Own Ireland 2024 (blog.infosectcbr.com.au)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

183

2

Let’s Be Objective: A Deep Dive into 0bj3ctivityStealer's Features (www.trellix.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

184

3

XWorm V6: 高度な回避機能と AMSI バイパス機能が明らかに - XWorm V6: Advanced Evasion and AMSI Bypass Capabilities Revealed (www.netskope.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

185

2

2025 GenAI Code Security Report: ASSESSING THE SECURITY OF USING LLMS FOR CODING (www.veracode.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

186

2

machofile: machofile is a module to parse Mach-O binary files (github.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

187

3

autoswagger: Autoswagger by Intruder - detect API auth weaknesses (github.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

188

3

ICANN writes letter to Web Commerce Communications Limited dba WebNic.cc for not dealing with DNS domain abuse reports (www.icann.org)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

189

4

When Privileged Access Falls into the Wrong Hands: Chinese Companies in Microsoft’s MAPP Program (nattothoughts.substack.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

190

5

Microsegmentation in Zero Trust Part One: Introduction and Planning (www.cisa.gov)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

191

3

Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing (www.proofpoint.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

192

6

More than 90 state, local governments targeted using Microsoft SharePoint vulnerability, group says (archive.ph)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

193

0

Introducing Unit 42’s Attribution Framework (unit42.paloaltonetworks.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

194

5

RingReaper: Linux post-exploitation agent that uses io_uring to stealthily bypass EDR detection by avoiding traditional syscalls. (github.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

195

1

Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations (research.checkpoint.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

196

3

Attackers abusing Proofpoint & Intermedia link wrapping to deliver phishing payloads (www.cloudflare.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

197

2

CISA and USCG Issue Joint Advisory to Strengthen Cyber Hygiene in Critical Infrastructure (www.cisa.gov)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

198

1

What Comes After Detection Rules? Smarter Detection Strategies in ATT&CK (medium.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

199

3

Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats (www.microsoft.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

200

1

Using LLMs as a reverse engineering sidekick (blog.talosintelligence.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink