blueteamsec

537 readers

21 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

1

2

CTO at NCSC Summary: week ending November 2nd (ctoatncsc.substack.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

2

4

Bypassing WiFi Client Isolation (pulsesecurity.co.nz)

submitted 16 hours ago by digicat to c/blueteamsec

0 comments fedilink

3

3

Attacking macOS XPC Helpers: Protocol Reverse Engineering and Interface Analysis (tonygo.tech)

submitted 16 hours ago by digicat to c/blueteamsec

0 comments fedilink

4

2

The ZeroAccess Developer and His Windows Kernel-Mode Debugger (r136a1.dev)

submitted 14 hours ago by digicat to c/blueteamsec

0 comments fedilink

5

2

You are worker #41: Lophiid Honeypot Caught an Automated AI Attack Swarm (medium.com)

submitted 15 hours ago by digicat to c/blueteamsec

0 comments fedilink

6

2

Don’t take BADCANDY from strangers – How your devices could be implanted and what to do about it - Cisco (www.cyber.gov.au)

submitted 15 hours ago by digicat to c/blueteamsec

0 comments fedilink

7

1

Identity Management for Agentic AI by OpenID (openid.net)

submitted 15 hours ago by digicat to c/blueteamsec

0 comments fedilink

8

11

Is Your Bluetooth Chip Leaking Secrets via RF Signals? (eprint.iacr.org)

submitted 1 day ago by digicat to c/blueteamsec

4 comments fedilink

9

1

Certified OysterLoader: Tracking Rhysida ransomware gang activity via code-signing certificates (expel.com)

submitted 15 hours ago by digicat to c/blueteamsec

0 comments fedilink

10

1

Don’t take BADCANDY from strangers – How your devices could be implanted and what to do about it - Cisco (www.cyber.gov.au)

submitted 15 hours ago by digicat to c/blueteamsec

0 comments fedilink

11

1

Tracking Lateral Movement: PowerShell Remoting, WMIC, Explicit Credentials, NTLM Relay Attacks, Credential Theft and Reuse (Event IDs) (medium.com)

submitted 15 hours ago by digicat to c/blueteamsec

0 comments fedilink

12

1

Tracking Lateral Movement — Named Pipes, Scheduler, Services, Registry, and DCOM (Event IDs) (medium.com)

submitted 15 hours ago by digicat to c/blueteamsec

0 comments fedilink

13

10

Security Community Slams MIT-linked Report Claiming AI Powers 80% of Ransomware (socket.dev)

submitted 1 day ago by digicat to c/blueteamsec

0 comments fedilink

14

3

BOF_Spawn: Cobalt Strike BOF for beacon/shellcode injection using fork & run technique with Draugr synthetic stack frames (github.com)

submitted 1 day ago by digicat to c/blueteamsec

0 comments fedilink

15

3

A Defender's Guide to Privileged Account Monitoring | Google Cloud Blog (cloud.google.com)

submitted 1 day ago by digicat to c/blueteamsec

0 comments fedilink

16

0

Evading Elastic Security: Linux Rootkit Detection Bypass (matheuzsecurity.github.io)

submitted 15 hours ago by digicat to c/blueteamsec

0 comments fedilink

17

2

Open VSX security update, October 2025 (blogs.eclipse.org)

submitted 1 day ago by digicat to c/blueteamsec

0 comments fedilink

18

5

EDR-Redir V2: Blind EDR With Fake Program Files (www.zerosalarium.com)

submitted 1 day ago by digicat to c/blueteamsec

0 comments fedilink

19

4

Decrypted: Midnight Ransomware - Midnight ransomware echoes Babuk’s tactics but stumbles in its code. Gen researchers explain how those mistakes make decryption and recovery possible (www.gendigital.com)

submitted 1 day ago by digicat to c/blueteamsec

0 comments fedilink

20

3

A Comprehensive Survey of Threat Intelligence Research: A Measurement-Based Study (dl.acm.org)

submitted 1 day ago by digicat to c/blueteamsec

0 comments fedilink

21

3

Державна служба спеціального зв’язку та захисту інформації України - Finland Joins Tallinn Mechanism to Bolster Ukraine's Cyber Resilience (cip.gov.ua)

submitted 1 day ago by digicat to c/blueteamsec

0 comments fedilink

22

3

Yet Another DCOM Object for Command Execution Part 1 (sud0ru.ghost.io)

submitted 1 day ago by digicat to c/blueteamsec

0 comments fedilink

23

3

Hunting for EDR-Freeze (blog.axelarator.net)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

24

2

NTLMPasswordChanger: PowerShell tool that shows how to read and write NTLM OWF values via samlib.dll. (github.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

25

2

Exploiting Ghost SPNs and Kerberos Reflection for SMB Privilege Elevation (www.semperis.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink