blueteamsec

557 readers
15 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat@infosec.pub
listing: all - local
701
3
Threat Actor Profile: APT27 (www.dexpose.io)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
702
1
EarlyExceptionHandling: Implementing an early exception handler for hooking and threadless process injection without relying on VEH or SEH (github.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
703
2
Microsoft Vulnerable Driver Block Lists in CSV and JSON for SIEM lookups - Microsoft removed the list and started distributing them as JSON - this gets you back to where we were (github.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
704
1
raw-gadget: USB Raw Gadget — a low-level interface for the Linux USB Gadget subsystem (github.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
705
1
release-tampering-pocs: Proof of Concepts for malicious maintainers: How to Tamper with Releases built with GitHub Actions Worfklows, presented at fwd:cloudsec Europe 2025 (github.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
706
1
[0day] From Spotlight to Apple Intelligence (objective-see.org)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
707
1
Detecting enumeration in AWS (falconforce.nl)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
708
0
Potential Actor Token Abuse in Entra ID KQL (github.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
709
1
ShadowLeak: A Zero-Click, Service-Side Attack Exfiltrating Sensitive Data Using ChatGPT’s Deep Research Agent (www.radware.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
710
2
Using ASPM to Implement Application Runtime Security Observation in Large Securities Firms (mp.weixin.qq.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
711
1
MPAF: Encrypted Traffic Classification With Multi-Phase Attribute Fingerprint (ieeexplore.ieee.org)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
712
1
FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography (www.acronis.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
713
2
More Fun With WMI (specterops.io)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
714
3
Keeping privacy when running queries: how to obfuscate your KQL results (www.michalos.net)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
715
1
疑似APT-C-00（海莲花）投递Havoc木马 - Suspected APT-C-00 (OceanLotus) delivering the Havoc Trojan (mp.weixin.qq.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
716
3
Gamaredon X Turla collab (www.welivesecurity.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
717
1
Modus Operandi of Subtle Snail (catalyst.prodaft.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
718
1
Malicious Listener for Ivanti Endpoint Mobile Management Systems (www.cisa.gov)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
719
2
DIGITAL FRONTLINES : INDIA UNDER MULTI-NATION HACKTIVIST ATTACK - CYFIRMA (www.cyfirma.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
720
1
obex: Obex – Blocking unwanted DLLs in user mode (github.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
721
1
United Kingdom National Charged in Connection with Multiple Cyber Attacks, Including on Critical Infrastructure (www.justice.gov)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
722
1
Teenagers charged over Transport for London cyber attack (www.bbc.co.uk)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
723
4
External attack surface management (EASM) buyer's guide (www.ncsc.gov.uk)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
724
1
MySonicWall Cloud Backup File Incident (www.sonicwall.com)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
725
3
One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens (dirkjanm.io)
submitted 2 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
view more: ‹ prev next ›