blueteamsec

556 readers
9 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat@infosec.pub
listing: all - local
676
2
EDR-Freeze: EDR-Freeze is a tool that puts a process of EDR, AntiMalware into a coma state. (github.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
677
1
Thalha Jubair DOJ complaint - alleged Scattered Spider (www.documentcloud.org)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
678
4
From Abstract Terms to Acumen: SEO Poisoning (medium.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
679
4
Domain Fronting is Dead. Long Live Domain Fronting! (www.praetorian.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
3 comments fedilink
680
0
Hunting for SnakeDisk (www.knowyouradversary.ru)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
681
0
Hunting for PyPI Packages Delivering SilentSync RAT (www.knowyouradversary.ru)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
682
0
That's How Adversaries Disable Warning Messages (www.knowyouradversary.ru)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
683
0
Another Legitimate Web Service Abused by APT28 (www.knowyouradversary.ru)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
684
0
That's How Bloody Wolf Abuses WMI for Discovery (www.knowyouradversary.ru)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
685
1
That's How Adversaries Abuse WMI for Software Discovery (www.knowyouradversary.ru)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
686
-2
That's How Adversaries Modify Registry to Weaken Security (www.knowyouradversary.ru)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
687
2
GOLD SALEM’s Warlock operation joins busy ransomware landscape (news.sophos.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
688
3
Blog: Beyond Sandbox Domains: Rendering Untrusted Web Content with SafeContentFrame (bughunters.google.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
689
2
ByteCaster: Swiss Army Knife for payload encryption, obfuscation, and conversion to byte arrays – all in a single command (14 output formats supported)! ☢️ (github.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
1 comments fedilink
690
0
‘I Was a Weird Kid’: Jailhouse Confessions of a Teen Hacker (www.bloomberg.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
1 comments fedilink
691
5
Unmasking Akira: The ransomware tactics you can’t afford to ignore (zensec.co.uk)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
692
3
NCSC Summary: week ending September 21st (ctoatncsc.substack.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
693
3
Threat Actor Profile: APT27 (www.dexpose.io)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
694
1
EarlyExceptionHandling: Implementing an early exception handler for hooking and threadless process injection without relying on VEH or SEH (github.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
695
2
Microsoft Vulnerable Driver Block Lists in CSV and JSON for SIEM lookups - Microsoft removed the list and started distributing them as JSON - this gets you back to where we were (github.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
696
1
raw-gadget: USB Raw Gadget — a low-level interface for the Linux USB Gadget subsystem (github.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
697
1
release-tampering-pocs: Proof of Concepts for malicious maintainers: How to Tamper with Releases built with GitHub Actions Worfklows, presented at fwd:cloudsec Europe 2025 (github.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
698
1
[0day] From Spotlight to Apple Intelligence (objective-see.org)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
699
1
Detecting enumeration in AWS (falconforce.nl)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
700
0
Potential Actor Token Abuse in Entra ID KQL (github.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
view more: ‹ prev next ›