blueteamsec

557 readers
16 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat@infosec.pub
listing: all - local
976
2
Inline Style Exfiltration: leaking data with chained CSS conditionals (portswigger.net)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
977
4
AI-powered ransomware named PromptLock - uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts on the fly (threadreaderapp.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
1 comments fedilink
978
4
Automating Detection Documentation and Changelog Generation (blog.nviso.eu)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
979
3
MSIXBuilder: MSIX Building Made Easy for Defenders (github.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
980
3
ZipLine Phishing Campaign Targets U.S. Manufacturing (research.checkpoint.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
981
3
Belarus-Linked DSLRoot Proxy Network Deploys Hardware in U.S. Residences, Including Military Homes (infrawatch.app)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
982
3
ScreenConnect Super Admin Credential Phishing Campaign Targets IT Leaders (www.mimecast.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
983
3
PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats (cloud.google.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
984
5
Detecting ManualFinder/PDF Editor Malware Campaign with KQL (www.lindensec.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
985
3
Exploring Microsoft Sentinel: Deploying a SOC Lab for Threat Hunting. (vedanttapdiya.medium.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
986
3
LLM4Binary (LLM4Binary) - Reverse Engineering: Decompiling Binary Code with Large Language Models - model continues to be updated latest was June, 2025 which was 6.7b v1.6 - a 6.7 billion-parameter (huggingface.co)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
 
 

https://github.com/albertan017/LLM4Decompile

987
3
Chrome-App-Bound-Encryption-Decryption: Fully decrypt App-Bound Encrypted (ABE) cookies, passwords & payment methods from Chromium-based browsers (Chrome, Brave, Edge) - all in user mode, no admin (github.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
988
5
Raising security with organization-wide YubiKey (FIDO2) in Entra ID (www.huntandhackett.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
989
5
How Token Protection Enhances Conditional Access Policies - Entra - Token Protection is a Conditional Access session control that attempts to reduce token replay attacks by ensuring only device bound (learn.microsoft.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
990
3
What’s new in Microsoft Intune: May 2025 - "we're allowing organizations to set up access policies that will require approval from another administrator before taking remote actions like retire/wipe" (techcommunity.microsoft.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
991
3
XDRStoryParser: Visualize Microsoft Defender XDR process trees and security events (github.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
992
4
KQL: ExternalData - Cert Central, CertReport - "If this returns TRUE, it means that the cert has been reported in CertReport and therefore, there are high chances that this file is malicious." (github.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
993
3
mssqlkaren: modified mssqlclient from impacket to extract policies from the SCCM database (github.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
994
4
rustdllproxy: Crate for generating and hooking into proxy DLLs with Rust. (github.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
995
2
Profiling Sea Turtle: Tactics, History & Defenses - "Sea Turtle is a Türkiye-nexus threat actor known for conducting state-affiliated espionage operations since at least 2017." (www.invictus-ir.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
996
5
Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery (www.cloudsek.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
997
6
🌀 Fast-Flux DNS: How Malware Uses DNS to Stay Invisible (medium.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
998
2
From Campus to C2: Tracking a Persistent Chinese Operation Against Vietnamese Universities (ctrlaltint3l.github.io)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
999
4
Uncovering the Chinese Proxy Service Used in APT Campaigns (spur.us)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
1000
5
Chinese National Sentenced to Prison for Deploying Destructive Computer Code on Ohio-based Company’s Global Network (www.justice.gov)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
view more: ‹ prev next ›