digicat

joined 2 years ago
MODERATOR OF
blueteamsec
sorted by: new top controversial old
1
Platform SSO configuration guide for macOS devices using Microsoft Intune - "configure Platform SSO to enable single sign-on (SSO) for your macOS devices using passwordless authentication, Microsoft E (learn.microsoft.com)
2
2025 Minimum Elements for a Software Bill of Materials (SBOM) - CISA is requesting public comment on its updated guidance on Software Bill of Materials (SBOM) (www.cisa.gov)
2
GraphApiAuditEvents: The new Graph API Logs (kqlquery.com)
MC1137611 - Deception feature in Microsoft Defender for Endpoint will be retired from public preview | Microsoft 365 Message Center Archive in c/blueteamsec@infosec.pub
4
MC1133508 - Microsoft Teams Integration with Microsoft Defender for Office Tenant Allow/Block List for blocking domains | Microsoft 365 Message Center Archive (mc.merill.net)
3
MC1137611 - Deception feature in Microsoft Defender for Endpoint will be retired from public preview | Microsoft 365 Message Center Archive (mc.merill.net)
3
Limiting Onmicrosoft Domain Usage for Sending Emails | Microsoft Community Hub (techcommunity.microsoft.com)
2
Think before you Click(Fix): Analyzing the ClickFix social engineering technique (www.microsoft.com)
2
The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War (www.cloudsek.com)
1
A new, cheaper Mac stealer emerges (moonlock.com)
3
The Masked Man in Cyber Attacks: Analysis of the DupeDog Software Framework (mp.weixin.qq.com)
3
APT36: Targets Indian BOSS Linux Systems with Weaponized AutoStart Files (www.cyfirma.com)
3
koney: Koney is a Kubernetes operator that enables you to define so-called deception policies for your cluster. Koney automates and uses eBPF to detect, log, and forward alerts (github.com)
HKLM\SYSTEM\Setup\sMarTdEpLoY -  The (Static) Keys to Abusing PDQ SmartDeploy in c/blueteamsec@infosec.pub
Breaking Into Your Network? Zer0 Effort. - DEF CON 33 Overview - research campaign investigating the security of Zero Trust Network Access solutions in c/blueteamsec@infosec.pub
ITW CRITICAL SECURITY BULLETIN: Trend Micro Apex One™ (On-Premise) Management Console Command Injection RCE Vulnerabilities in c/blueteamsec@infosec.pub
malefic: IoM implant, C2 Framework and Infrastructure - use seen in the wild in c/blueteamsec@infosec.pub
Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities in c/blueteamsec@infosec.pub
Welcome to the new home of what was /r/Blueteamsec and how it works.. in c/blueteamsec@infosec.pub
[–] digicat@infosec.pub 1 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

I think this might need to be @jerry

Welcome to the new home of what was /r/Blueteamsec and how it works.. in c/blueteamsec@infosec.pub
[–] digicat@infosec.pub 1 points 3 weeks ago

V welcome..

LOLRMM is a curated list of Remote Monitoring and Management (RMM) - now with SIEM detections - see comment for important PR for KQL in c/blueteamsec@infosec.pub
[–] digicat@infosec.pub 1 points 3 weeks ago

note this PR which needs integrating for the KQL to work - https://github.com/magicsword-io/LOLRMM/pull/100

Shutting the Door on Vishing-Driven Data Theft in Salesforce - "UNC6040’s phone-phishers lure employees into approving a fake dataloader[.]io app, hijacking Salesforce APIs to siphon customer data." in c/blueteamsec@infosec.pub
Shutting the Door on Vishing-Driven Data Theft in Salesforce - "UNC6040’s phone-phishers lure employees into approving a fake dataloader[.]io app, hijacking Salesforce APIs to siphon customer data." in c/blueteamsec@infosec.pub
Clorox versus Cognizant Complaint - Cognizant’sconduct on August 11, 2023, demonstrated spectacularly that it was failing to do so. Cognizantrepeatedly gave a cybercriminal access to Clorox’s network in c/blueteamsec@infosec.pub
view more: next ›