blueteamsec

437 readers

39 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

151

2

machofile: machofile is a module to parse Mach-O binary files (github.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

152

3

autoswagger: Autoswagger by Intruder - detect API auth weaknesses (github.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

153

3

ICANN writes letter to Web Commerce Communications Limited dba WebNic.cc for not dealing with DNS domain abuse reports (www.icann.org)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

154

4

When Privileged Access Falls into the Wrong Hands: Chinese Companies in Microsoft’s MAPP Program (nattothoughts.substack.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

155

5

Microsegmentation in Zero Trust Part One: Introduction and Planning (www.cisa.gov)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

156

3

Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing (www.proofpoint.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

157

6

More than 90 state, local governments targeted using Microsoft SharePoint vulnerability, group says (archive.ph)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

158

0

Introducing Unit 42’s Attribution Framework (unit42.paloaltonetworks.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

159

5

RingReaper: Linux post-exploitation agent that uses io_uring to stealthily bypass EDR detection by avoiding traditional syscalls. (github.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

160

1

Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations (research.checkpoint.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

161

3

Attackers abusing Proofpoint & Intermedia link wrapping to deliver phishing payloads (www.cloudflare.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

162

2

CISA and USCG Issue Joint Advisory to Strengthen Cyber Hygiene in Critical Infrastructure (www.cisa.gov)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

163

1

What Comes After Detection Rules? Smarter Detection Strategies in ATT&CK (medium.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

164

3

Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats (www.microsoft.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

165

1

Using LLMs as a reverse engineering sidekick (blog.talosintelligence.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

166

1

Email-Delivered RMM: Abusing PDFs for Silent Initial Access (labs.withsecure.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

167

1

How North Korea-Backed Lazarus Group Is Weaponizing Open Source to Target Developers (www.sonatype.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

168

4

M365 Email OSINT After the Lockdown: What Still Works in 2025 (dstreefkerk.github.io)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

169

2

The Covert Operator's Playbook: Infiltration of Global Telecom Networks (unit42.paloaltonetworks.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

170

1

Node-SAML SAML Signature Verification Vulnerability - "Node-SAML loads the assertion from the (unsigned) original response document...is different than the parts that are verified when checking sig" (github.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

171

2

Eviction Strategies Tool: A Tool for Building Containment and Eviction Playbooks (www.cisa.gov)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

172

2

Extending AD CS attack surface to the cloud with Intune certificates - "means going from regular user and their endpoint to Domain Admin in AD, all from the cloud. This blog explores the scenarios" (dirkjanm.io)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

173

3

A fresh look for the Microsoft authentication background - Microsoft changing the background on authentication screens - may cause phishing reporting.. (techcommunity.microsoft.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

174

1

LOLRMM is a curated list of Remote Monitoring and Management (RMM) - now with SIEM detections - see comment for important PR for KQL (lolrmm.io)

submitted 1 week ago* (last edited 1 week ago) by digicat to c/blueteamsec

1 comments fedilink

175

1

깃헙브 데이터 저장소를 악용한 김수키(Kimsuky) 전자세금계산서 사칭 악성코드 공격-전자세금계산서.pdf.lnk(2025.7.23) - Kimsuky Electronic Tax Invoice Fraud Attack Exploiting GitHub Data Repository - Electronic Tax Invoice.pdf.lnk (wezard4u.tistory.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink