blueteamsec

493 readers
22 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
[email protected]
listing: all - local
226
3
LLM4Binary (LLM4Binary) - Reverse Engineering: Decompiling Binary Code with Large Language Models - model continues to be updated latest was June, 2025 which was 6.7b v1.6 - a 6.7 billion-parameter (huggingface.co)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
 
 

https://github.com/albertan017/LLM4Decompile

227
3
Chrome-App-Bound-Encryption-Decryption: Fully decrypt App-Bound Encrypted (ABE) cookies, passwords & payment methods from Chromium-based browsers (Chrome, Brave, Edge) - all in user mode, no admin (github.com)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
228
5
Raising security with organization-wide YubiKey (FIDO2) in Entra ID (www.huntandhackett.com)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
229
5
How Token Protection Enhances Conditional Access Policies - Entra - Token Protection is a Conditional Access session control that attempts to reduce token replay attacks by ensuring only device bound (learn.microsoft.com)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
230
3
What’s new in Microsoft Intune: May 2025 - "we're allowing organizations to set up access policies that will require approval from another administrator before taking remote actions like retire/wipe" (techcommunity.microsoft.com)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
231
3
XDRStoryParser: Visualize Microsoft Defender XDR process trees and security events (github.com)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
232
4
KQL: ExternalData - Cert Central, CertReport - "If this returns TRUE, it means that the cert has been reported in CertReport and therefore, there are high chances that this file is malicious." (github.com)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
233
3
mssqlkaren: modified mssqlclient from impacket to extract policies from the SCCM database (github.com)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
234
4
rustdllproxy: Crate for generating and hooking into proxy DLLs with Rust. (github.com)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
235
2
Profiling Sea Turtle: Tactics, History & Defenses - "Sea Turtle is a Türkiye-nexus threat actor known for conducting state-affiliated espionage operations since at least 2017." (www.invictus-ir.com)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
236
5
Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery (www.cloudsek.com)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
237
6
🌀 Fast-Flux DNS: How Malware Uses DNS to Stay Invisible (medium.com)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
238
2
From Campus to C2: Tracking a Persistent Chinese Operation Against Vietnamese Universities (ctrlaltint3l.github.io)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
239
4
Uncovering the Chinese Proxy Service Used in APT Campaigns (spur.us)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
240
5
Chinese National Sentenced to Prison for Deploying Destructive Computer Code on Ohio-based Company’s Global Network (www.justice.gov)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
241
5
The head of a hacking group that also targeted BTS's Jungkook and the president has been arrested and extradited by the Ministry of Justice - " repatriated Chinese national" (www.yna.co.kr)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
 
 

https://www.sportskeeda.com/us/k-pop/news-head-hacking-ring-reportedly-stole-8-4-billion-won-hybe-shares-bts-jungkook-arrested

242
7
You don’t find ManualFinder, ManualFinder finds you - "we’re seeing activity where PUPs are dropping highly suspicious files, executing unexpected commands, and turning hosts into residential proxies" (expel.com)
submitted 2 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
243
4
Detecting CVE-2025-43300: A Deep Dive into Apple's DNG Processing Vulnerability | Matt Suiche (www.msuiche.com)
submitted 3 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
244
18
Phishing Emails Are Now Aimed at Users and AI Defenses - "Clearly written in the style of Grok, Gemini or ChatGPT style prompts,. nothing to do with luring the users. Instead.. n AI prompt-injection" (malwr-analysis.com)
submitted 3 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
245
2
REcover: towards recovering object files from stripped binary executables (link.springer.com)
submitted 3 weeks ago* (last edited 3 weeks ago) by [email protected] to c/[email protected]
0 comments fedilink
 
 

https://github.com/huku-/recover

246
3
SynoScope is a python-based, lightweight, batteries-included analyzer that turns can provide valuable information regarding your DiskStation Manager (DSM) status within the undocumented Synology recov (github.com)
submitted 3 weeks ago by [email protected] to c/[email protected]
1 comments fedilink
247
3
Countering EDRs With The Backing Of Protected Process Light (PPL) (www.zerosalarium.com)
submitted 3 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
248
3
Platform SSO configuration guide for macOS devices using Microsoft Intune - "configure Platform SSO to enable single sign-on (SSO) for your macOS devices using passwordless authentication, Microsoft E (learn.microsoft.com)
submitted 3 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
249
3
2025 Minimum Elements for a Software Bill of Materials (SBOM) - CISA is requesting public comment on its updated guidance on Software Bill of Materials (SBOM) (www.cisa.gov)
submitted 3 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
250
3
GraphApiAuditEvents: The new Graph API Logs (kqlquery.com)
submitted 3 weeks ago by [email protected] to c/[email protected]
0 comments fedilink
view more: ‹ prev next ›