blueteamsec

465 readers
8 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat@infosec.pub
listing: all - local
376
2
Extending AD CS attack surface to the cloud with Intune certificates - "means going from regular user and their endpoint to Domain Admin in AD, all from the cloud. This blog explores the scenarios" (dirkjanm.io)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
377
3
A fresh look for the Microsoft authentication background - Microsoft changing the background on authentication screens - may cause phishing reporting.. (techcommunity.microsoft.com)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
378
1
LOLRMM is a curated list of Remote Monitoring and Management (RMM) - now with SIEM detections - see comment for important PR for KQL (lolrmm.io)
submitted 3 weeks ago* (last edited 3 weeks ago) by digicat@infosec.pub to c/blueteamsec@infosec.pub
1 comments fedilink
379
1
깃헙브 데이터 저장소를 악용한 김수키(Kimsuky) 전자세금계산서 사칭 악성코드 공격-전자세금계산서.pdf.lnk(2025.7.23) - Kimsuky Electronic Tax Invoice Fraud Attack Exploiting GitHub Data Repository - Electronic Tax Invoice.pdf.lnk (wezard4u.tistory.com)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
380
1
유튜브 동영상 다운로드 사이트에서 유포 중인 Proxyware 악성코드 - Proxyware malware circulating on YouTube video download sites (asec.ahnlab.com)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
381
4
What the Israel-Iran conflict revealed about wartime cyber operations (www.atlanticcouncil.org)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
382
2
Closing the Execution Gap: Hardware-Backed Telemetry for Detecting Out-Of-Context Execution (info.preludesecurity.com)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
383
2
Clorox versus Cognizant Complaint - Cognizant’sconduct on August 11, 2023, demonstrated spectacularly that it was failing to do so. Cognizantrepeatedly gave a cybercriminal access to Clorox’s network (www.documentcloud.org)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
1 comments fedilink
384
1
Two (or Too Many) Cheers for UN Cyber Diplomacy? (carnegieendowment.org)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
385
2
Entra Connect Attacker Tradecraft: Part 3 (specterops.io)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
386
1
Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition (arxiv.org)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
1 comments fedilink
387
1
Targeted attacks leverage accounts on popular online platforms as C2 servers - Cobalt Strike Beacon delivered via GitHub and social media (securelist.com)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
388
1
China’s Covert Capabilities | Silk Spun From Hafnium (www.sentinelone.com)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
389
3
APT28’s New Arsenal: LAMEHUG, the First AI-Powered Malware - previously reported by the Ukrainian CERT (www.logpoint.com)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
390
3
Mimo gang weaponizes religious symbols to deliver 4L4MD4r ransomware using Microsoft SharePoint RCE vulnerability - reporting from China (mp-weixin-qq-com.translate.goog)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
391
1
Lionishackers: Analyzing a corporate database seller (outpost24.com)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
392
1
How a Cyber Alliance Took Down Russian Cybercrime (www.csis.org)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
393
10
US Senator Maria Cantwell (D-WA) demands that Google-owned incident response firm Mandiant hand over the Salt Typhoon-related security assessments of AT&T and Verizon (www.commerce.senate.gov)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
 
 
394
1
RABIDS: Modular malware framework to build custom payloads, designed for advanced adversary simulation and malware research (github.com)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
395
1
Information to Insights: Intrusion Analysis Methodology (www.huntress.com)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
396
1
DPAPI Backup Key Compromise Pt. 1: Some Forests Must Burn (specterops.io)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
397
2
LARVA-208 compromised the Steam game Chemia to distribute multiple malware families - Indicators of Compromise (github.com)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
1 comments fedilink
398
1
MCPSpy: MCP Monitoring with eBPF (github.com)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
399
1
eBPF: Handling events in Userspace (h0x0er.github.io)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
400
1
Sentrilite – Open source, Lightweight, Real time, Kernel level System Observability and Audit tool (Powered by eBPF + AI) (github.com)
submitted 3 weeks ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
view more: ‹ prev next ›