blueteamsec

428 readers
33 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
76
6
theProtector: Linux Bash Script for the Paranoid Admin on a Budget - real-time monitoring and active threat response (github.com)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
77
4
RansomFS: an example of using canary files and directories, chained with different threshold engines to map a PID to its malicious behaviour and trigger a response when this threshold is breached. (github.com)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
78
3
APT28’s New Arsenal: LAMEHUG, the First AI-Powered Malware - previously reported by the Ukrainian CERT (www.logpoint.com)
submitted 4 days ago by digicat to c/blueteamsec
0 comments fedilink
79
3
Mimo gang weaponizes religious symbols to deliver 4L4MD4r ransomware using Microsoft SharePoint RCE vulnerability - reporting from China (mp-weixin-qq-com.translate.goog)
submitted 4 days ago by digicat to c/blueteamsec
0 comments fedilink
80
4
PyPI Users Email Phishing Attack - The Python Package Index Blog (blog.pypi.org)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
81
6
Hackers Destroy Aeroflot’s IT Infrastructure, Causing Over 42 Flight Cancellations - "destroyed around 7,000 physical and virtual servers, exfiltrated over 22 terabytes of data" (militarnyi.com)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
82
6
ToolShell: a story of five vulnerabilities in Microsoft SharePoint (securelist.com)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
83
4
MSSQLHound: PowerShell collector for adding MSSQL attack paths to BloodHound with OpenGraph (github.com)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
84
2
Entra Connect Attacker Tradecraft: Part 3 (specterops.io)
submitted 4 days ago by digicat to c/blueteamsec
0 comments fedilink
85
3
MaaS Appeal: An Infostealer Rises From The Ashes — NOVABLIGHT is a NodeJS-based Malware-as-a-Service (MaaS) information stealer developed and sold by a threat group that demonstrates French-language (www.elastic.co)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
86
3
GOLD BLADE remote DLL sideloading attack deploys RedLoader (news.sophos.com)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
87
3
Privacy Enhancing Technologies Symposium videos (youtube.com)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
88
3
United States files a civil complaint in the Northern District of Texas seeking the forfeiture of over $1.7 million worth of cryptocurrency seized by Dallas FBI (www.justice.gov)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
89
1
LOLRMM is a curated list of Remote Monitoring and Management (RMM) - now with SIEM detections - see comment for important PR for KQL (lolrmm.io)
submitted 4 days ago* (last edited 4 days ago) by digicat to c/blueteamsec
1 comments fedilink
90
1
깃헙브 데이터 저장소를 악용한 김수키(Kimsuky) 전자세금계산서 사칭 악성코드 공격-전자세금계산서.pdf.lnk(2025.7.23) - Kimsuky Electronic Tax Invoice Fraud Attack Exploiting GitHub Data Repository - Electronic Tax Invoice.pdf.lnk (wezard4u.tistory.com)
submitted 4 days ago by digicat to c/blueteamsec
0 comments fedilink
91
1
유튜브 동영상 다운로드 사이트에서 유포 중인 Proxyware 악성코드 - Proxyware malware circulating on YouTube video download sites (asec.ahnlab.com)
submitted 4 days ago by digicat to c/blueteamsec
0 comments fedilink
92
0
Introducing Unit 42’s Attribution Framework (unit42.paloaltonetworks.com)
submitted 3 days ago by digicat to c/blueteamsec
0 comments fedilink
93
4
Rooting the TP-Link Tapo C200 Rev.5 (quentinkaiser.be)
submitted 5 days ago by digicat to c/blueteamsec
1 comments fedilink
94
4
Taming the Windows Module Loading for Stealthy Injection (youtu.be)
submitted 5 days ago by digicat to c/blueteamsec
1 comments fedilink
95
4
No[one|thing] will be left behind — Manual guide to patch your the exiled SharePoint/Exchange server (testbnull.medium.com)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
96
4
theProtector: Linux Bash Script for the Paranoid Admin on a Budget - real-time monitoring and active threat response (github.com)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
97
2
LARVA-208 compromised the Steam game Chemia to distribute multiple malware families - Indicators of Compromise (github.com)
submitted 5 days ago by digicat to c/blueteamsec
1 comments fedilink
98
2
Umbral Stealer config extractor.ipynb - Config extractor of obfuscated umbral stealer samples and CLEANED (de4dot) samples writen in DotNet. hashes (github.com)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
99
2
TPwSav.sys Driver - Arbitrary Physical Memory Read and Write Primitive (zeifan.my)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
100
2
Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal - The campaign leverages malicious advertisements to lure victims to install fake applications which impersonate ~ 50 common apps (research.checkpoint.com)
submitted 5 days ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›