blueteamsec

445 readers
17 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
201
4
When Privileged Access Falls into the Wrong Hands: Chinese Companies in Microsoft’s MAPP Program (nattothoughts.substack.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
202
5
Microsegmentation in Zero Trust Part One: Introduction and Planning (www.cisa.gov)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
203
3
Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing (www.proofpoint.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
204
6
More than 90 state, local governments targeted using Microsoft SharePoint vulnerability, group says (archive.ph)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
205
0
Introducing Unit 42’s Attribution Framework (unit42.paloaltonetworks.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
206
5
RingReaper: Linux post-exploitation agent that uses io_uring to stealthily bypass EDR detection by avoiding traditional syscalls. (github.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
207
1
Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations (research.checkpoint.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
208
3
Attackers abusing Proofpoint & Intermedia link wrapping to deliver phishing payloads (www.cloudflare.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
209
2
CISA and USCG Issue Joint Advisory to Strengthen Cyber Hygiene in Critical Infrastructure (www.cisa.gov)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
210
1
What Comes After Detection Rules? Smarter Detection Strategies in ATT&CK (medium.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
211
3
Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats (www.microsoft.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
212
1
Using LLMs as a reverse engineering sidekick (blog.talosintelligence.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
213
1
Email-Delivered RMM: Abusing PDFs for Silent Initial Access (labs.withsecure.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
214
1
How North Korea-Backed Lazarus Group Is Weaponizing Open Source to Target Developers (www.sonatype.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
215
4
M365 Email OSINT After the Lockdown: What Still Works in 2025 (dstreefkerk.github.io)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
216
2
The Covert Operator's Playbook: Infiltration of Global Telecom Networks (unit42.paloaltonetworks.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
217
1
Node-SAML SAML Signature Verification Vulnerability - "Node-SAML loads the assertion from the (unsigned) original response document...is different than the parts that are verified when checking sig" (github.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
218
2
Eviction Strategies Tool: A Tool for Building Containment and Eviction Playbooks (www.cisa.gov)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
219
2
Extending AD CS attack surface to the cloud with Intune certificates - "means going from regular user and their endpoint to Domain Admin in AD, all from the cloud. This blog explores the scenarios" (dirkjanm.io)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
220
3
A fresh look for the Microsoft authentication background - Microsoft changing the background on authentication screens - may cause phishing reporting.. (techcommunity.microsoft.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
221
1
LOLRMM is a curated list of Remote Monitoring and Management (RMM) - now with SIEM detections - see comment for important PR for KQL (lolrmm.io)
submitted 1 week ago* (last edited 1 week ago) by digicat to c/blueteamsec
1 comments fedilink
222
1
깃헙브 데이터 저장소를 악용한 김수키(Kimsuky) 전자세금계산서 사칭 악성코드 공격-전자세금계산서.pdf.lnk(2025.7.23) - Kimsuky Electronic Tax Invoice Fraud Attack Exploiting GitHub Data Repository - Electronic Tax Invoice.pdf.lnk (wezard4u.tistory.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
223
1
유튜브 동영상 다운로드 사이트에서 유포 중인 Proxyware 악성코드 - Proxyware malware circulating on YouTube video download sites (asec.ahnlab.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
224
4
What the Israel-Iran conflict revealed about wartime cyber operations (www.atlanticcouncil.org)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
225
2
Closing the Execution Gap: Hardware-Backed Telemetry for Detecting Out-Of-Context Execution (info.preludesecurity.com)
submitted 1 week ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›