digicat

joined 2 years ago
MODERATOR OF
blueteamsec
sorted by: new top controversial old
1
Subtle Snail (UNC1549, TA455), an Iran-nexus espionage group linked to the Eclipsed Wasp (Charming Kitten) network, has been active since at least November 2022 - IoCs (github.com)
1
WSL-Payloads: A small How-To on creating your own weaponized WSL file (github.com)
1
Detection Engineering: Practicing Detection-as-Code - Validation - Part 3 (blog.nviso.eu)
1
Linux-persistence: A no-reboot, in-memory Linux persistence PoC leveraging namespace joining, user-namespace elevation, and self‑deletion. (github.com)
3
The Threat Hunter's Cookbook (www.splunk.com)
3
SCENE 1: SoupDealer - Technical Analysis of a Stealth Java Loader Used in Phishing Campaigns Targeting Türkiye (www.malwation.com)
2
クルド人グループによる日本の組織を狙ったサイバー攻撃 - Cyber attacks by Kurdish groups targeting Japanese organizations (jp.security.ntt)
3
Microsoft Releases Guidance on High-Severity Vulnerability (CVE-2025-53786) in Hybrid Exchange Deployments (www.cisa.gov)
2
BamboozlEDR: A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes. (github.com)
3
Hidden Black Hands: How $1.46 Billion Disappeared in Silence - "This incident demonstrates the exceptionally targeted nature of Lazarus's attacks" (mp.weixin.qq.com)
1
turnt: A tool designed for smuggling interactive command and control traffic through legitimate TURN servers hosted by reputable providers such as Zoom. (github.com)
3
Trust Me, I’m a Legitimate Process: Verisimilitude and the Art of Hiding (nasbench.medium.com)
ITW CRITICAL SECURITY BULLETIN: Trend Micro Apex One™ (On-Premise) Management Console Command Injection RCE Vulnerabilities in c/blueteamsec@infosec.pub
malefic: IoM implant, C2 Framework and Infrastructure - use seen in the wild in c/blueteamsec@infosec.pub
Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities in c/blueteamsec@infosec.pub
Welcome to the new home of what was /r/Blueteamsec and how it works.. in c/blueteamsec@infosec.pub
[–] digicat@infosec.pub 1 points 5 days ago* (last edited 5 days ago) (1 children)

I think this might need to be @jerry

Welcome to the new home of what was /r/Blueteamsec and how it works.. in c/blueteamsec@infosec.pub
LOLRMM is a curated list of Remote Monitoring and Management (RMM) - now with SIEM detections - see comment for important PR for KQL in c/blueteamsec@infosec.pub
[–] digicat@infosec.pub 1 points 1 week ago

note this PR which needs integrating for the KQL to work - https://github.com/magicsword-io/LOLRMM/pull/100

Shutting the Door on Vishing-Driven Data Theft in Salesforce - "UNC6040’s phone-phishers lure employees into approving a fake dataloader[.]io app, hijacking Salesforce APIs to siphon customer data." in c/blueteamsec@infosec.pub
Shutting the Door on Vishing-Driven Data Theft in Salesforce - "UNC6040’s phone-phishers lure employees into approving a fake dataloader[.]io app, hijacking Salesforce APIs to siphon customer data." in c/blueteamsec@infosec.pub
Clorox versus Cognizant Complaint - Cognizant’sconduct on August 11, 2023, demonstrated spectacularly that it was failing to do so. Cognizantrepeatedly gave a cybercriminal access to Clorox’s network in c/blueteamsec@infosec.pub
LARVA-208 compromised the Steam game Chemia to distribute multiple malware families - Indicators of Compromise in c/blueteamsec@infosec.pub
Welcome to the new home of what was /r/Blueteamsec and how it works.. in c/blueteamsec@infosec.pub
[–] digicat@infosec.pub 5 points 1 week ago (1 children)

Nope, very manual and the plan is to stay here :) - I managed to keep the last community going at this rate for ~8 years.

Ability to share links in c/voyagerapp@lemmy.world
[–] digicat@infosec.pub 4 points 1 week ago

Almost need 'Voyager link post'

view more: next ›