blueteamsec

429 readers

26 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

151

1

DFIR-IRIS: developed by Airbus CERT (France), is an open source solution designed to efficiently manage the entire incident response chain. (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

152

1

Ghosting the Sensor: Disrupting Defender for Identity Without Detection (cyberdom.blog)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

153

1

Detecting ADCS Privilege Escalation (www.blackhillsinfosec.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

154

1

Shutting the Door on Vishing-Driven Data Theft in Salesforce - "UNC6040’s phone-phishers lure employees into approving a fake dataloader[.]io app, hijacking Salesforce APIs to siphon customer data." (appomni.com)

submitted 5 days ago by digicat to c/blueteamsec

2 comments fedilink

155

1

Tracing Bugs Across Kernels: SMB Vulnerabilities in macOS and FreeBSD (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

156

1

SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers - "first observed ToolShell exploitation on July 17th, ahead of official Microsoft advisories." (www.sentinelone.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

157

1

Allianz Life says majority of customers' data stolen in hack (archive.ph)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

158

1

NCSC and CERT NZ integration now complete (www.ncsc.govt.nz)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

159

1

Webshell Detection Script for Citrix Netscaler appliances - TLPCLEAR_check_script_cve-2025-6543-v1.7.sh (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

160

1

Modular PIC C2 Agents - "This makes it possible (at least in theory) to write a C2 agent that is made up of multiple individual PICOs, rather than a singular monolithic DLL or PIC code base" (rastamouse.me)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

161

1

Killer-Exercice: An Exercice for Red Team to Reverse & Exploit, that's a valid BYOVD Killer, not HVCI Blocklisted, and not in LOLBIN (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

162

1

RAIWhateverTrigger: Local SYSTEM auth trigger for relaying - based on the original RAITrigger technique that abuses the RAiForceElevationPromptForCOM RPC function in appinfo.dll to trigger SYSTEM auth (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

163

1

Escaping the Confines of Port 445 - "TL;DR NTLM relay attacks on SMB restrict lateral movement to port 445/TCP capabilities. To extend beyond, leverage the Service Control Manager (SCM) remotely" (specterops.io)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

164

1

SRAM Has No Chill: Exploiting Power Domain Separation to Steal On-Chip Secrets (cacm.acm.org)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

165

1

Microsoft Probing If Chinese Hackers Learned SharePoint Flaws Through Alert - Microsoft Corp. is investigating whether a leak from its early alert system for cybersecurity companies allowed Chinese ha (archive.ph)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

166

1

Intelligent Prediction: How Large Language Models Revolutionize Subdomain Discovery Technology (mp-weixin-qq-com.translate.goog)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

167

1

Reforging Sliver: How Simple Code Edits Can Outmaneuver EDR (fortbridge.co.uk)

submitted 6 days ago by digicat to c/blueteamsec

0 comments fedilink

168

1

Cybersecurity Advisory: Scattered Spider (www.cisa.gov)

submitted 6 days ago by digicat to c/blueteamsec

0 comments fedilink

169

1

Muddled Libra Threat Assessment: Further-Reaching, Faster, More Impactful (unit42.paloaltonetworks.com)

submitted 6 days ago by digicat to c/blueteamsec

0 comments fedilink

170

0

NachoVPN: Now With More VPN (And SYSTEM Shells) - Part 1 (blog.amberwolf.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

171

1

Following NoName057(16) DDoSia Project’s Targets (blog.sekoia.io)

submitted 2 years ago by campuscodi to c/blueteamsec

0 comments fedilink

172

3

Process Mockingjay: Echoing RWX In Userland To Achieve Code Execution (www.securityjoes.com)

submitted 2 years ago by campuscodi to c/blueteamsec

1 comments fedilink

173

9

The Enemy Within: Threat Actors Target Subdomains of Trusted Global Brands in Mass Open Redirect Abuse. (www.silentpush.com)

submitted 2 years ago by campuscodi to c/blueteamsec

2 comments fedilink

174

12

DNS Analyzer - Finding DNS vulnerabilities with Burp Suite (sec-consult.com)

submitted 2 years ago by campuscodi to c/blueteamsec

0 comments fedilink

175

6

A technical analysis of the SALTWATER backdoor used in Barracuda 0-day vulnerability (CVE-2023-2868) exploitation (cybergeeks.tech)

submitted 2 years ago by campuscodi to c/blueteamsec

0 comments fedilink