blueteamsec

429 readers

36 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

126

1

How a Cyber Alliance Took Down Russian Cybercrime (www.csis.org)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

127

1

RABIDS: Modular malware framework to build custom payloads, designed for advanced adversary simulation and malware research (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

128

1

Information to Insights: Intrusion Analysis Methodology (www.huntress.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

129

1

DPAPI Backup Key Compromise Pt. 1: Some Forests Must Burn (specterops.io)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

130

1

MCPSpy: MCP Monitoring with eBPF (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

131

1

eBPF: Handling events in Userspace (h0x0er.github.io)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

132

1

Sentrilite – Open source, Lightweight, Real time, Kernel level System Observability and Audit tool (Powered by eBPF + AI) (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

133

1

DESCG: data encoding scheme classification with GNN in binary analysis (link.springer.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

134

1

Invisible Traces: Using Hybrid Fingerprinting to identify underlying LLMs in GenAI Apps (arxiv.org)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

135

1

Explainable Vulnerability Detection in C/C++ Using Edge-Aware Graph Attention Networks (arxiv.org)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

https://github.com/Radowan98/ExplainVulD

136

1

PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python (arxiv.org)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

137

2

Gunra Ransomware Group Unveils Efficient Linux Variant (www.trendmicro.com)

submitted 6 days ago by digicat to c/blueteamsec

0 comments fedilink

138

2

CTO at NCSC Summary: week ending July 27th (ctoatncsc.substack.com)

submitted 6 days ago by digicat to c/blueteamsec

0 comments fedilink

139

2

SSDT Hooking via Alt Syscalls for ETW Evasion (fluxsec.red)

submitted 6 days ago by digicat to c/blueteamsec

0 comments fedilink

140

2

The AltSyscalls module is designed merely as the intercept mechanism for using Alternate Syscalls on Windows 11 (github.com)

submitted 6 days ago* (last edited 6 days ago) by digicat to c/blueteamsec

0 comments fedilink

141

1

AntiDebug: Windows anti-debugging sandbox (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

142

1

Cyber Deception: State of the art, Trends and Open challenges (arxiv.org)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

143

1

An important update (and apology) on our PoisonSeed blog (expel.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

144

1

Under the Hood of AFD.sys Part 1: Investigating Undocumented Interfaces - "NtCreateFile to craft a raw TCP socket via AFD.sys on Windows 11, completely skipping Winsock" (leftarcode.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

145

1

LOTS-Project-Rework: This folder acts as a "rework" of the original LOTS (Living Off Trusted Sites) Project - The LOTS-Project website never had a CSV and/or JSON (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

146

1

ysonet: Deserialization payload generator for a variety of .NET formatters - YSoNet is a fork and replacement of YSoSerial .Net - incs ysonet.exe -p sharepoint --cve=CVE-2025-49704 -var 2 -c "C:\temp (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

147

1

The Evolution of Threat Hunting: From IOC Whack-a-Mole to Hypothesis-Driven Sleuthing (medium.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

148

1

TAG Bulletin: Q2 2025 (blog.google)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

149

1

Fake Zoom Call Lures for Zoom Workplace Credentials (cofense.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

150

1

Malware in Panda Image Hides Persistent Linux Threat - "This technique isn’t steganography but rather polyglot file abuse or malicious file embedding. " - ignore the AI (www.aquasec.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink