blueteamsec

544 readers

9 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

1

1

CTO at NCSC Summary: week ending November 9th (ctoatncsc.substack.com)

submitted 22 hours ago by digicat to c/blueteamsec

0 comments fedilink

2

3

Congressional Budget Office believed to be hacked by foreign actor (archive.ph)

submitted 1 hour ago by digicat to c/blueteamsec

0 comments fedilink

3

2

Runtime Android Object Instrumentation (knifecoat.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

4

1

conquest: Conquest is a feature-rich and malleable command & control/post-exploitation framework developed in Nim. (github.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

5

1

SHGenOb: Python based tool for generating Shellcode from PIC C (github.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

6

1

EtwLeakKernel: Leaking kernel addresses from ETW consumers. Requires Administrator privileges. (github.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

7

1

venom: Venom C2 is a dependency‑free Python3 Command & Control framework for redteam persistence (github.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

8

1

DCSDevilCOM: A C# tool for requesting certificates from ADCS using DCOM over SMB. This tool allows you to remotely request X.509 certificates from CA server using the MS-WCCE protocol over DCOM (github.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

9

1

Hacking GraalVM Espresso: Abusing Continuation API to Make ROP-Like Attack (github.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

10

1

Implementing the Etherhiding technique (medium.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

11

1

teams-cookies-bof: BOF to steal Teams cookies (github.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

12

1

Evading Elastic EDR's call stack signatures with call gadgets (offsec.almond.consulting)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

13

1

Weaponizing Trust: ClickOnce Deployment with AppDomainManager Injection (malcrove.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

14

1

DonPwner: Advanced Domain Controller attack and credential analysis tool leveraging DonPAPI database (github.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

15

1

ESET APT Activity Report Q2 2025–Q3 2025 (www.welivesecurity.com)

submitted 11 hours ago by digicat to c/blueteamsec

0 comments fedilink

16

1

ESET APT Activity Report Q2 2025–Q3 2025 (www.welivesecurity.com)

submitted 11 hours ago by digicat to c/blueteamsec

0 comments fedilink

17

3

What’s That Coming Over The Hill? (Monsta FTP Remote Code Execution CVE-2025-34299) (labs.watchtowr.com)

submitted 20 hours ago by digicat to c/blueteamsec

0 comments fedilink

18

1

JA4+ Plugin for Wireshark (github.com)

submitted 16 hours ago by digicat to c/blueteamsec

0 comments fedilink

19

2

SoK: Honeypots & LLMs, More Than the Sum of Their Parts? (arxiv.org)

submitted 20 hours ago by digicat to c/blueteamsec

0 comments fedilink

20

2

警惕！APT-C-08（蔓灵花）组织首次借WinRAR漏洞CVE-2025-6218实施网络攻击 - Beware! The APT-C-08 (Manlinghua) group has launched its first cyberattack using the WinRAR vulnerability CVE-2025-6218. (mp.weixin.qq.com)

submitted 20 hours ago by digicat to c/blueteamsec

0 comments fedilink

21

5

Site Unseen: Enumerating and Attacking Active Directory Sites (www.synacktiv.com)

submitted 1 day ago by digicat to c/blueteamsec

0 comments fedilink

22

2

Data-Structure Injection (DSI) in AI Agents (labs.zenity.io)

submitted 21 hours ago by digicat to c/blueteamsec

0 comments fedilink

23

3

BSI TR -03185-2 Secure Software Lifecycle for Open Source Software (www.bsi.bund.de)

submitted 1 day ago by digicat to c/blueteamsec

0 comments fedilink

24

4

LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices (unit42.paloaltonetworks.com)

submitted 1 day ago by digicat to c/blueteamsec

0 comments fedilink

25

13

Meta is earning a fortune on a deluge of fraudulent ads, documents show (archive.ph)

submitted 2 days ago by digicat to c/blueteamsec

1 comments fedilink