digicat

joined 2 years ago

MODERATOR OF

1

What Comes After Detection Rules? Smarter Detection Strategies in ATT&CK (medium.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

3

Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats (www.microsoft.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

1

Using LLMs as a reverse engineering sidekick (blog.talosintelligence.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

1

Email-Delivered RMM: Abusing PDFs for Silent Initial Access (labs.withsecure.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

1

How North Korea-Backed Lazarus Group Is Weaponizing Open Source to Target Developers (www.sonatype.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

4

M365 Email OSINT After the Lockdown: What Still Works in 2025 (dstreefkerk.github.io)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

2

The Covert Operator's Playbook: Infiltration of Global Telecom Networks (unit42.paloaltonetworks.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

1

Node-SAML SAML Signature Verification Vulnerability - "Node-SAML loads the assertion from the (unsigned) original response document...is different than the parts that are verified when checking sig" (github.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

2

Eviction Strategies Tool: A Tool for Building Containment and Eviction Playbooks (www.cisa.gov)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

2

Extending AD CS attack surface to the cloud with Intune certificates - "means going from regular user and their endpoint to Domain Admin in AD, all from the cloud. This blog explores the scenarios" (dirkjanm.io)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

3

A fresh look for the Microsoft authentication background - Microsoft changing the background on authentication screens - may cause phishing reporting.. (techcommunity.microsoft.com)

submitted 2 days ago by digicat to c/blueteamsec

0 comments fedilink

1

LOLRMM is a curated list of Remote Monitoring and Management (RMM) - now with SIEM detections - see comment for important PR for KQL (lolrmm.io)

submitted 2 days ago* (last edited 2 days ago) by digicat to c/blueteamsec

1 comments fedilink