blueteamsec

550 readers
24 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat@infosec.pub
listing: all - local
51
3
Creating a YARA Repository (brkalbyrk.github.io)
submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
52
3
Threat Intelligence Report: APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets (dti.domaintools.com)
submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
53
4
Operation WrtHug, The Global Espionage Campaign Hiding in Your Home Router (securityscorecard.com)
submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
54
1
magnet: Purple-team telemetry & simulation toolkit. (github.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
55
1
CustomC2ChannelTemplate: template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader. (github.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
56
1
Systematically Deconstructing APVD Steganography and its Payload with a Unified Deep Learning Paradigm - ""our model achieves a detection accuracy of 96.2 percent." (arxiv.org)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
57
1
疑似APT-C-26（Lazarus）组织利用远程IT伪装部署监控程序的攻击行动分析 - Analysis of attack activities suspected to be deployed by the APT-C-26 (Lazarus) group using remote IT spoofing to deploy surveillance programs (mp.weixin.qq.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
58
1
MuddyWater组织近期钓鱼攻击活动分析 - Analysis of MuddyWater's Recent Phishing Attacks (mp.weixin.qq.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
59
1
The Guardians of Name Street: Studying the Defensive Registration Practices of the Fortune 500 (fabianmonrose.github.io)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
60
1
Understanding Orphan Flows: This work presents the first large-scale analysis of orphan flows to understand 1) the practical hurdles to measuring orphan flows, and 2) the potential utility for SOCs (angelosk.github.io)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
61
1
From Concealment to Exposure: Understanding the Lifecycle and Infrastructure of APT Domains (tillsongalloway.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
62
1
Towards understanding the lifecycle of malicious network infrastructure (repository.gatech.edu)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
63
1
ForgeDAN: An Evolutionary Framework for Jailbreaking Aligned Large Language Models (arxiv.org)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
64
1
Deciphering Multi-Layer Hidden Loads and Analyzing Drive-Level Blinding Countermeasures | Tracking the Tactics and Techniques of the Silver Fox (mp.weixin.qq.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
65
1
BOF_RunPe: BOF to run PE in Cobalt Strike Beacon without console creation (github.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
66
2
TelemetryCollectionManager: Manage and maintain Defender XDR custom collection configuration (github.com)
submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
67
2
UNC2891:ATM Threats Never Die - How a device small enough to fit in your pocket – a Raspberry Pi – became the key to infiltrating entire ATM networks (www.group-ib.com)
submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
68
2
Fortinet published an advisory for CVE-2025-58034. it is an authenticated command injection vulnerability affecting FortiWeb. Fortinet and CISA have indicated that it has been exploited in-the-wild (attackerkb.com)
submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
69
2
Analysis of attack activities suspected to be deployed by the APT-C-26 (Lazarus) group using remote IT spoofing to deploy surveillance programs (mp.weixin.qq.com)
submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
70
2
Client certificate or certificate plus domain authentication - Endpoint Management guidance to address ESC1. They now explicitly instruct admins to revoke the "Enroll" permission from Domain Users. (docs.citrix.com)
submitted 6 days ago* (last edited 6 days ago) by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
71
2
Driver Reversing 101 - Part II: Unpacking a VMProtected Boot Driver (eversinc33.com)
submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
72
-5
Start using Windows Autopatch (learn.microsoft.com)
submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
1 comments fedilink
73
4
JA4D and JA4D6: DHCP Fingerprinting (foxio.io)
submitted 1 week ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
74
3
ENISA Sectorial Threat Landscape - Public Administration (www.enisa.europa.eu)
submitted 1 week ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
75
1
Reframing Insights | Chollima Group (chollima-group.io)
submitted 1 week ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
view more: ‹ prev next ›