blueteamsec

444 readers
11 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
276
1
Shutting the Door on Vishing-Driven Data Theft in Salesforce - "UNC6040’s phone-phishers lure employees into approving a fake dataloader[.]io app, hijacking Salesforce APIs to siphon customer data." (appomni.com)
submitted 2 weeks ago by digicat to c/blueteamsec
2 comments fedilink
277
1
Tracing Bugs Across Kernels: SMB Vulnerabilities in macOS and FreeBSD (github.com)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
278
1
SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers - "first observed ToolShell exploitation on July 17th, ahead of official Microsoft advisories." (www.sentinelone.com)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
279
1
Allianz Life says majority of customers' data stolen in hack (archive.ph)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
280
1
NCSC and CERT NZ integration now complete (www.ncsc.govt.nz)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
281
1
Webshell Detection Script for Citrix Netscaler appliances - TLPCLEAR_check_script_cve-2025-6543-v1.7.sh (github.com)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
282
1
Modular PIC C2 Agents - "This makes it possible (at least in theory) to write a C2 agent that is made up of multiple individual PICOs, rather than a singular monolithic DLL or PIC code base" (rastamouse.me)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
283
1
Killer-Exercice: An Exercice for Red Team to Reverse & Exploit, that's a valid BYOVD Killer, not HVCI Blocklisted, and not in LOLBIN (github.com)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
284
1
RAIWhateverTrigger: Local SYSTEM auth trigger for relaying - based on the original RAITrigger technique that abuses the RAiForceElevationPromptForCOM RPC function in appinfo.dll to trigger SYSTEM auth (github.com)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
285
1
Escaping the Confines of Port 445 - "TL;DR NTLM relay attacks on SMB restrict lateral movement to port 445/TCP capabilities. To extend beyond, leverage the Service Control Manager (SCM) remotely" (specterops.io)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
286
1
SRAM Has No Chill: Exploiting Power Domain Separation to Steal On-Chip Secrets (cacm.acm.org)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
287
4
No[one|thing] will be left behind — Manual guide to patch your the exiled SharePoint/Exchange server (testbnull.medium.com)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
288
2
Root Cause Analysis of the CitrixBleed 2 (CVE-2025–5777) Vulnerability (medium.com)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
289
4
theProtector: Linux Bash Script for the Paranoid Admin on a Budget - real-time monitoring and active threat response (github.com)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
290
6
ToolShell: a story of five vulnerabilities in Microsoft SharePoint (securelist.com)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
291
1
Microsoft Probing If Chinese Hackers Learned SharePoint Flaws Through Alert - Microsoft Corp. is investigating whether a leak from its early alert system for cybersecurity companies allowed Chinese ha (archive.ph)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
292
1
Intelligent Prediction: How Large Language Models Revolutionize Subdomain Discovery Technology (mp-weixin-qq-com.translate.goog)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
293
2
Detecting the Most Popular MITRE Persistence Method – Registry Run Keys / Startup Folder (www.nextron-systems.com)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
294
10
Microsoft Used China-Based Support for Multiple U.S. Agencies, Potentially Exposing Sensitive Data (www.propublica.org)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
295
1
Reforging Sliver: How Simple Code Edits Can Outmaneuver EDR (fortbridge.co.uk)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
296
2
Process Injection using Return-Oriented Programming (ieeexplore.ieee.org)
submitted 2 weeks ago by digicat to c/blueteamsec
1 comments fedilink
297
62
Polish Train Maker Is Suing the Hackers Who Exposed Its Anti-Repair Tricks (www.ifixit.com)
submitted 2 weeks ago by digicat to c/blueteamsec
2 comments fedilink
298
1
Cybersecurity Advisory: Scattered Spider (www.cisa.gov)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
299
1
Muddled Libra Threat Assessment: Further-Reaching, Faster, More Impactful (unit42.paloaltonetworks.com)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
300
3
Pixels of Deception: How VMDetector Loader Hides in Plain Sight (www.sonicwall.com)
submitted 2 weeks ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›