blueteamsec

431 readers

19 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

1

1

CTO at NCSC Summary: week ending August 3rd (ctoatncsc.substack.com)

submitted 3 days ago by digicat to c/blueteamsec

0 comments fedilink

2

6

Exorcism: The first open source runtime windows batch and command line deobfuscator (github.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

3

3

Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem (www.sentinelone.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

4

3

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira (thedfirreport.com)

submitted 2 hours ago by digicat to c/blueteamsec

0 comments fedilink

5

1

IOCTL_VOLSNAP_DELETE_SNAPSHOT: Querying And Deleting Shadow Copies Using The IOCTL_VOLSNAP_QUERY_NAMES_OF_SNAPSHOTS & IOCTL_VOLSNAP_DELETE_SNAPSHOT IOCTLs (github.com)

submitted 4 hours ago by digicat to c/blueteamsec

0 comments fedilink

6

1

Perplexity is using stealth, undeclared crawlers to evade website no-crawl directives (blog.cloudflare.com)

submitted 4 hours ago by digicat to c/blueteamsec

0 comments fedilink

7

1

BSides Las Vegas - live streams - Mon, Tue and Wed (youtube.com)

submitted 4 hours ago by digicat to c/blueteamsec

0 comments fedilink

8

1

SQUID-2025:1 Buffer Overflow in URN Handling (github.com)

submitted 4 hours ago by digicat to c/blueteamsec

0 comments fedilink

9

1

Quantum networking technologies - "we provide an updated analysis of QKD as a security technology, and the development of QRNGs. We also consider the future of quantum networking technologies." (www.ncsc.gov.uk)

submitted 5 hours ago by digicat to c/blueteamsec

0 comments fedilink

10

1

EntraGoat - A Deliberately Vulnerable Entra ID Environment (github.com)

submitted 6 hours ago by digicat to c/blueteamsec

0 comments fedilink

11

2

Protecting the Evidence in Real-Time with KQL Queries - "monitoring for attempts to modify the corresponding registry keys can help us generate early alerts and detect potential tampering." (detect.fyi)

submitted 8 hours ago by digicat to c/blueteamsec

0 comments fedilink

12

2

Investigating Suspicious Memory Activity: Tracing a SIEM Alert to a Cobalt Strike C2 (daniyyell.com)

submitted 8 hours ago by digicat to c/blueteamsec

0 comments fedilink

13

1

Tracing ToneShell: Mustang Panda's Evolving Tradecraft and Campaign Infrastructure (archive.ph)

submitted 8 hours ago by digicat to c/blueteamsec

0 comments fedilink

14

2

White Paper for Cyberspace Mapping Techniques - from China (www.webray.com.cn)

submitted 10 hours ago by digicat to c/blueteamsec

0 comments fedilink

15

1

APT36 Targets Indian Infrastructure with Desktop Lures and Poseidon Backdoor (hunt.io)

submitted 8 hours ago by digicat to c/blueteamsec

0 comments fedilink

16

2

The Discriminative Power of Cross-layer RTTs in Fingerprinting Proxy Traffic - NDSS Symposium (www.ndss-symposium.org)

submitted 10 hours ago by digicat to c/blueteamsec

0 comments fedilink

17

1

DHS Launches Over $100 Million in Funding to Strengthen Communities’ Cyber Defenses | CISA (www.cisa.gov)

submitted 8 hours ago by digicat to c/blueteamsec

0 comments fedilink

18

1

PlayPraetor's evolving threat: How Chinese-speaking actors globally scale an Android RAT (www.cleafy.com)

submitted 8 hours ago by digicat to c/blueteamsec

0 comments fedilink

19

1

Memory Forensics Attack Simulation Dataset - " a curated memory forensics dataset designed to support research, detection engineering, and hands-on training in the fields of malware analysis, incident (daniyyell.com)

submitted 8 hours ago by digicat to c/blueteamsec

0 comments fedilink

20

1

암호화폐 거래소로 위장한 페이스북 광고에 의한 악성코드 유포 - Malware spread through Facebook ads disguised as cryptocurrency exchanges. (asec.ahnlab.com)

submitted 9 hours ago by digicat to c/blueteamsec

0 comments fedilink

21

1

malefic: IoM implant, C2 Framework and Infrastructure - use seen in the wild (github.com)

submitted 9 hours ago by digicat to c/blueteamsec

1 comments fedilink

22

1

CypherBench: Towards Precise Retrieval over Full-scale Modern Knowledge Graphs in the LLM Era - needed to augment those LLMs (arxiv.org)

submitted 10 hours ago by digicat to c/blueteamsec

0 comments fedilink

23

1

NachoVPN: Now With More VPN (And SYSTEM Shells) - Part 2 - Palo Alto GlobalProtect (blog.amberwolf.com)

submitted 10 hours ago by digicat to c/blueteamsec

0 comments fedilink

24

0

How to automatically disable users in AWS Managed Microsoft AD based on GuardDuty findings (aws.amazon.com)

submitted 8 hours ago by digicat to c/blueteamsec

0 comments fedilink

25

-1

白盒+LLM：京东操作类越权自动化检测实践 - using LLMs to find web vulns by gen'ing AST, generating graphs, function call graph (S)CG, a control flow graph (CFG), a data flow graph (DFG), a combined code property graph (mp.weixin.qq.com)

submitted 10 hours ago by digicat to c/blueteamsec

0 comments fedilink