#blueteam — Public Fediverse posts

SafeLine : un WAF prêt à protéger vos applis web des bots malveillants https://www.it-connect.fr/safeline-waf-prise-en-main/ #Cybersécurité #BlueTeam

SOC-Analyst Lern- & Praxishandbuch

Ich habe mir in den letzten Wochen ein eigenes SOC-Analyst Lern- & Praxishandbuch erstellt.

Gedacht ist es vor allem für Einsteiger, Interessierte und alle, die sich einen strukturierten Überblick über Security Operations und SOC verschaffen möchten.

Enthalten sind unter anderem Themen wie Netzwerke, SIEM, EDR/XDR, Threat Intelligence, Incident Response, Detection Engineering, Cloud Security, Malware-Analyse, Forensik sowie praktische Lernpfade und Tool-Empfehlungen.

Für mich war wichtig, Theorie und Praxis möglichst verständlich zusammenzubringen und gleichzeitig zu zeigen, was man als angehender SOC Analyst wirklich lernen und üben sollte.

Download: SOC-Analyst – Das umfassende Lern- & Praxishandbuch:

🔗 https://app.filen.io/#/d/7b65fb81-b0fc-43d7-bbe6-099188af2470%23747955317742336c626f366e72364877476f745a354658766430317550696f55

:boost_ok:

#CyberSecurity #SOC #BlueTeam #SecurityOperations #ITSecurity

We have updated https://www.valtersit.com/methodology/ with the actual information #CVE #Dokploy #infosec #SysAdmin #cybersecurity #Linux #infosec #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta

From now on all #CVe #CVEAlert additional to #yara #Sigma and #Suricate rules will have #Splunk #Wazuh rules all for FREE no tracking no registration, no payments! #cybersecurity #devsecops #devops #infosec #redteam #blueteam #github #gitlab #git #developers #developer info source and follow for more updates as there will be more EX: https://www.valtersit.com/cve/CVE-2026-9734/

What is Silver Ticket Attack: A Comprehensive Guide

In this article, I cover how Silver Ticket attacks work, common exploitation scenarios, detection techniques, and mitigation strategies.
https://denizhalil.com/2026/05/27/silver-ticket-attack-comprehensive-guide/

#CyberSecurity #ActiveDirectory #SilverTicket #Kerberos #CredentialAccess #RedTeam #BlueTeam #Pentesting #WindowsSecurity #InfoSec #ThreatDetection #DenizHalil

Kerbrute: Enumerating Active Directory Accounts

In this article, I cover how Kerberoasting works, common attack techniques, detection methods, and practical defense strategies.

🔗 https://denizhalil.com/2026/05/21/kerberoasting-attack-defense-guide/

#CyberSecurity #ActiveDirectory #Kerberoasting #Kerberos #CredentialAccess #RedTeam #BlueTeam #Pentesting #WindowsSecurity #InfoSec #ThreatDetection #DenizHalil

Basic Active Directory Enumeration: A Comprehensive Guide

In this article, I cover how Kerberoasting works, common attack techniques, detection methods, and practical defense strategies.
https://denizhalil.com/2025/05/05/basic-active-directory-enumeration-a-comprehensive-guide/

#CyberSecurity #ActiveDirectory #Kerberoasting #Kerberos #CredentialAccess #RedTeam #BlueTeam #Pentesting #WindowsSecurity #InfoSec #ThreatDetection #DenizHalil

What is Kerberoasting Attack – Kerberoasting: A Comprehensive Guide

In this article, I cover how Kerberoasting works, common attack techniques, detection methods, and practical defense strategies.
https://denizhalil.com/2026/05/21/kerberoasting-attack-defense-guide/

#CyberSecurity #ActiveDirectory #Kerberoasting #Kerberos #CredentialAccess #RedTeam #BlueTeam #Pentesting #WindowsSecurity #InfoSec #ThreatDetection #DenizHalil

Responder Tool for Network Credential Capture in Active Directory

In this article, I cover how Responder works, common credential capture techniques, and practical mitigation strategies for defending Active Directory environments.

https://denizhalil.com/2026/05/18/responder-tool-active-directory-credential-capture/

#CyberSecurity #ActiveDirectory #Responder #LLMNR #NTLM #CredentialCapture #RedTeam #BlueTeam #Pentesting #WindowsSecurity #InfoSec #EthicalHacking #DenizHalil

🔐 Just shipped a fix for the April 2026 Windows update (KB5083769) that flags unsigned RDP files as "Unknown Publisher".
If you manage RDP shortcuts via Intune and your users are suddenly seeing red security warnings — here's a complete solution:
✅ Self-signed code signing cert (no PKI required)
✅ rdpsign.exe signing workflow
✅ Intune Win32 package (install + uninstall scripts)
✅ Trusted Certificate profile + Settings Catalog policies
✅ Versioned detection rule for clean updates
✅ Supersedence pattern for migrating from unsigned deployments
Tested in production on a real M365 Business Premium environment.
🔗 github.com/Bluewal/m365-intune-scripts/tree/main/intune/rdp-signing
#Intune #Microsoft365 #RDP #BlueTeam #WindowsSecurity #MicrosoftDefender

What are Pass-the-Hash and Pass-the-Ticket Attacks: A Comprehensive Guide

In this article, I cover how these attacks work, their differences, and how to detect and mitigate them.
https://denizhalil.com/2026/01/05/pass-the-hash-pass-the-ticket-attacks-guide/

#cybersecurity #ActiveDirectory #PassTheHash #PassTheTicket #credentialaccess #RedTeam #BlueTeam #Pentesting #InfoSec #WindowsSecurity #EthicalHacking #ITSecurity #denizhalil

What is NetBIOS and SMB Exploitation Techniques: A Practical Guide

In this article, I cover key exploitation techniques, real-world attack scenarios, and how to secure these services effectively.

https://denizhalil.com/2026/01/15/netbios-smb-exploitation-techniques-guide/

#CyberSecurity #SMB #NetBIOS #NetworkSecurity #ActiveDirectory #RedTeam #BlueTeam #Pentesting #InfoSec #WindowsSecurity #EthicalHacking #ITSecurity #DenizHalil

SSH Tunneling and Port Forwarding Techniques: A Comprehensive Guide

In this article, I cover:
* How SSH tunneling works under the hood
* Local, remote, and dynamic port forwarding techniques
* Real-world use cases (databases, internal services, pivoting)
* Security risks and hardening recommendations

https://denizhalil.com/2026/02/02/ssh-tunneling-port-forwarding-guide/

#CyberSecurity #sshtunneling #portforwarding #NetworkSecurity #Linux #RedTeam #BlueTeam #Pentesting #InfoSec #securityengineering #EthicalHacking #ITSecurity

What is DCSync Attack and Mimikatz Usage in Active Directory

One of the most critical attacks in Active Directory environments, DCSync, allows attackers to impersonate a Domain Controller and extract password hashes through replication abuse.

#CyberSecurity #ActiveDirectory #DCSync #RedTeam #BlueTeam #InfoSec #Pentesting #SOC #ThreatDetection #WindowsSecurity #EthicalHacking #ITSecurity #NetworkSecurity #SecurityOperations #DenizHalil

https://denizhalil.com/2026/03/27/dcsync-attack-active-directory-guide/

Server Security Checklist — Essential Hardening Guide

Securing your servers isn’t optional — it’s your first line of defense against data breaches, ransomware, insider threats, and lateral movement. Use this checklist as a baseline for Linux, Windows, cloud, hybrid, or on-prem servers.

⸻

🔧 1. System & OS Hardening
• Keep OS & packages updated (apply security patches frequently).
• Remove / disable unused services & software.
• Enforce secure boot + BIOS/UEFI passwords.
• Disable auto-login and guest accounts.
• Use minimal OS images only (reduce attack surface).

⸻

🔐 2. Access Control
• Enforce strong passwords & MFA everywhere.
• Use RBAC & least privilege access.
• Disable root/Administrator login over SSH/RDP.
• Rotate credentials & keys regularly.
• Implement just-in-time access for privileged users.

⸻

🌐 3. Network Security
• Restrict inbound/outbound traffic via firewalls.
• Segment critical servers from general LANs/VLANs.
• Disable unused ports & protocols.
• Enable DoS/DDoS protection.
• Apply zero-trust network principles.

⸻

🔑 4. Secure Remote Access
• Use SSH key-based authentication (disable password login).
• Enforce VPN for admin access.
• Log & monitor all remote access sessions.
• Disable legacy protocols (Telnet, FTP, SMBv1).
• Require bastion/jump host for critical access.

⸻

📊 5. Logging & Monitoring
• Enable centralized logging (syslog / SIEM).
• Track failed login attempts & anomalies.
• Configure alerts for privilege escalation or config changes.
• Monitor log tampering.
• Retain logs securely for audits & forensics.

⸻

🔒 6. Data Protection
• Encrypt data at rest (LUKS, BitLocker, etc.).
• Encrypt data in transit (TLS 1.2+).
• Strict database access policies.
• Regular, offline, immutable backups.
• Test restore procedures (don’t assume backups work).

⸻

🔁 7. Application & Patch Management
• Keep middleware, frameworks, and apps patched.
• Delete default credentials & sample files.
• Enable code signing for software packages.
• Use secure coding practices (OWASP Top 10).
• Implement dependency scanning (Snyk, Trivy, etc.).

⸻

🛡️ 8. Malware & Intrusion Defense
• Deploy EDR/AV on endpoints.
• Enable IDS/IPS at network edge.
• Automatic vulnerability scans (schedule weekly/monthly).
• Monitor persistence techniques (cron, startup scripts).
• Block known malicious IP ranges & TLDs.

⸻

🏢 9. Physical & Cloud Security
• Restrict physical access to server racks/rooms.
• Enable provider security tools (AWS Security Groups, Azure NSG, IAM).
• Harden cloud images (CIS benchmarks).
• Review cloud logging & audit trails regularly.
• Disable unused cloud API keys / roles.

⸻

📜 10. Policy & Compliance
• Use CIS / NIST / ISO-27001 benchmarks.
• Track & document every access change.
• Force annual access reviews & key rotation.
• Perform regular security training for admins.
• Maintain disaster recovery & incident plans.

⸻

➕ Additional 5 Critical Controls (Advanced Hardening)

🧠 11. Privileged Access Management (PAM)
• Use jump hosts & session recording.
• Just-In-Time access for admins.
• Store keys in secure vaults (HashiCorp Vault, CyberArk).

🚨 12. Real-Time Threat Detection
• Use behavioral analytics → UEBA/XDR.
• AI-based anomaly detection recommended.
• Block suspicious IPs automatically.

🧪 13. Red Team & Pentesting
• Run regular internal pentests.
• Validate configuration weaknesses.
• Simulate phishing + lateral movement scenarios.

🧱 14. Container / VM Isolation
• Use AppArmor, SELinux, Seccomp profiles.
• Limit Docker socket access & root containers.
• Scan images before deployment.

📦 15. Automated Configuration Management
• Use IaC (Terraform, Ansible, Puppet) for repeatable and secure builds.
• Detect drift using compliance scanning.
• Version control all infrastructure.

⸻

🧠 Core Reminder

A server is only as secure as the team who maintains it.
Hardening isn’t one task — it’s an ongoing

#ServerSecurity #SystemHardening #InfoSec #CyberSecurity #BlueTeam
#DevSecOps #SysAdmin #ThreatDetection #AccessControl #NetworkSecurity
#LinuxSecurity #SecureArchitecture #RiskMitigation #SecurityChecklist
#CloudSecurity #InfrastructureSecurity #ZeroTrust #SecurityMonitoring

Post-Earnings Dip: Why You Shouldn't Get Too Comfortable on Cybersecurity Gains

Just when you thought it was safe to go back in the market, cybersecurity stocks like Palo Alto Networks take a hit after strong quarterly results. But what does this mean for your online safety?

As cybersecurity companies continue to report impressive earnings, it's essential to remember that security is an ongoing battle. New vulnerabilities and threats emerge daily, making it crucial to stay vigilant.

So, are you taking the necessary steps to protect your digital fortress? What's your top concern when it comes to cybersecurity? Share with us in the comments below!

#CybersecurityMatters #DigitalSafetyFirst #StaySecure

#InfoSec # Cybersecurity #BlueTeam

Read more: https://short.steelefortress.com/ffww3t

📋 Server Security Checklist — Essential Hardening Guide 🛡️

Securing servers is critical to protect sensitive data, applications, and networks. Here’s a quick checklist every sysadmin and security engineer should follow to reduce risk and strengthen resilience. ⚡🔐

1️⃣ System & OS Hardening
🔹 Keep OS and packages updated (apply patches regularly).
🔹 Remove or disable unused services & software.
🔹 Configure secure boot and BIOS/UEFI passwords.

2️⃣ Access Control
🔹 Enforce strong passwords + MFA for all accounts.
🔹 Use role-based access (least privilege).
🔹 Disable root/administrator login over SSH/RDP.

3️⃣ Network Security
🔹 Restrict inbound/outbound traffic with firewalls.
🔹 Segment critical servers from general networks.
🔹 Disable unused ports & protocols.

4️⃣ Secure Remote Access
🔹 Use SSH with key-based auth (disable password logins).
🔹 Enforce VPNs for admin access.
🔹 Monitor and log remote sessions.

5️⃣ Logging & Monitoring
🔹 Enable centralized logging (syslog/SIEM).
🔹 Monitor failed login attempts & unusual activity.
🔹 Configure alerts for critical events.

6️⃣ Data Protection
🔹 Encrypt sensitive data at rest & in transit (TLS, disk encryption).
🔹 Regularly back up data to secure, offline storage.
🔹 Apply strict database access policies.

7️⃣ Application & Patch Management
🔹 Keep middleware, frameworks, and apps patched.
🔹 Remove default credentials and sample configs.
🔹 Use secure coding practices.

8️⃣ Malware & Intrusion Defense
🔹 Deploy antivirus/EDR for endpoints.
🔹 Enable IDS/IPS at the network edge.
🔹 Scan regularly for vulnerabilities.

9️⃣ Physical & Cloud Security
🔹 Restrict physical access to server rooms.
🔹 Harden cloud instances with provider tools (security groups, IAM).
🔹 Regularly review cloud audit logs.

🔟 Policy & Compliance
🔹 Apply CIS/NIST benchmarks.
🔹 Document access, configs, and changes.
🔹 Train admins in security best practices.

#ServerSecurity #CyberSecurity #InfoSec #BlueTeam #SysAdmin #ITSecurity #SecurityChecklist #DefensiveSecurity

🔥 HACKFEST 17e ÉDITION - FORMATIONS EXCLUSIVES 🔥

📅 Du 13 au 16 octobre 2025 ⏰ Toutes les formations débutent à 9h00

🎯 Prêt à faire passer tes compétences en cybersécurité au niveau supérieur ?

✨ AU PROGRAMME :
- Sécurité 101-102-103 - La formation signature créée par notre communauté !
- Sécurité Physique 101-201-202 - Blue Team, Red Team & Rétro-ingénierie
- PowerShell pour l'équipe bleue - 5e édition exclusive au Hackfest !
- Formation Cloud Pragmatique & Security Ops - Maîtrisez le cloud en toute sécurité !
- Gestion de crise - Apprenez à dominer face aux menaces !
- Cyberdéfense opérationnelle PME - Optimisez vos ressources limitées
- OSINT/Social Engineering Bootcamp - Avec Shane MacDougall (2x DEF CON black badge winner) - en anglais

🚨 Ces formations sont UNIQUES et créées spécialement par et pour la communauté Hackfest !

💪 Que tu sois débutant ou expert, il y a une formation qui t'attend pour transformer ton approche de la cybersécurité.

👉 Inscris-toi maintenant : hackfest.ca/fr/formations/

#Hackfest #Hackfest2025 #hf2025 #Cybersecurity #Formation #InfoSec #Quebec #Montreal #GestionDeCrise #CyberDefense #SecuritéCloud #SécuritéPhysique #CyberSécurité #blueteam #redteam #cloudops #cloudsecurity #RetroIngenierie

🏢 Cybersecurity Checklist for Small Business – Quick Guide

Small businesses are prime targets for cyberattacks. A simple, structured checklist helps reduce risk, protect customer data, and keep operations safe.

💡 Key Items:

🔑 Strong Passwords + MFA – Enforce complexity and multi-factor authentication.

💻 Update & Patch – Keep OS, apps, and firmware current.

📡 Secure Wi-Fi – Use WPA3, strong passphrases, and separate guest networks.

📂 Regular Backups – Offline + cloud copies, test restores.

👤 Access Control – Least privilege for staff; disable unused accounts.

🛡 Endpoint Protection – Antivirus, EDR, and device encryption.

📧 Phishing Awareness – Train employees to spot suspicious emails.

🔥 Firewalls & VPN – Protect remote access and monitor inbound/outbound traffic.

📊 Incident Response Plan – Define who to call, what to do, and test annually.

🔍 Vendor & Supply Chain Security – Validate partners, use secure contracts.

⚠️ Disclaimer:
This checklist is for educational purposes only and should be adapted to your business’s unique risks.

#CyberSecurity #SmallBusiness #InfoSec #SMB #DataProtection #CyberAwareness #SecurityChecklist #BlueTeam #BusinessSecurity

🚨 Critical Magento & Adobe Commerce Flaw (CVE-2025-54236 – SessionReaper) 🚨

Impact: Customer account takeover + unauthenticated remote code execution (CVSS 9.1 Critical).

👉 Full details and action steps: https://hostvix.com/sessionreaper-critical-magento-adobe-commerce-vulnerability-cve-2025-54236/

#Magento #AdobeCommerce #SessionReaper #CVE202554236 #CVE #Infosec #CyberSecurity #AppSec #WebSecurity #SecOps #BlueTeam #RedTeam #ThreatIntel #Vulnerability #PatchNow #ZeroDay #Exploit #EcommerceSecurity #DataSecurity #SecurityUpdate

🐽 Snort Command Cheat Sheet: Understand Network Threats Like a Pro

Snort is a powerful open-source tool used for Network Intrusion Detection and Prevention (NIDS/NIPS). It's widely adopted by blue teams and security professionals to monitor, alert, and defend against malicious network activity.

🧠 Key Usage Modes (No Code Needed):

• Test Mode: Check configuration files before deployment
• Packet Sniffing Mode: Monitor live traffic and display it in real time
• Packet Logging Mode: Capture packets and store them for analysis
• IDS Mode: Analyze traffic against rule sets and raise alerts
• Silent Mode: Run in the background while logging events

🛡️ Snort is great for:
• Detecting port scans and suspicious payloads
• Monitoring traffic for policy violations
• Integrating with SIEM solutions
• Practicing blue team defensive strategies

Disclaimer: This content is intended strictly for educational and awareness purposes. Use intrusion detection systems responsibly and ethically.

#Snort #NetworkSecurity #CyberSecurity #InfoSec #BlueTeam #IDS #EducationOnly #IntrusionDetection #SOCTools #PacketAnalysis

Cybersecurity Week at TEDIC: A space to protect our lives in the Digital age

In a world where technology permeates every aspect of our lives, cybersecurity has become more than a protective measure; it’s a form of autonomy. From simple daily actions like safeguarding our passwords to defending digital activism against sophisticated attacks, the di

https://www.tedic.org/cybersecurity-week/

#Blog #CitizenParticipation #InformationAccess #blueteam #BTTs #cybersecurity #DigitalSecurity

There is something so satisfying in kicking off an entire RFC1918 scan.

Doing a single port at a brisk but safe (for my environment) pace.

~/# nmap -Pn -n -p <single port number> -T4 --open 10.0.0.0/8

~/# nmap -Pn -n -p <single port number> -T4 --open 172.16.0.0/12

~/# nmap -Pn -n -p <single port number> -T4 --open 192.168.0.0/16

(command broken out for dramatic effect - also note that I break out each of those CIDRs into /24's so that if anything breaks, I can pick up easier where the last known good ended. It's scripted and I prefer it this way.)

I am not doing a ping sweep or a DNS resolution. I'm assuming all hosts are up. And I'm looking for every host with a single port open. So even if they dont respond to pings (or something is preventing pings), I should get an answer back.

Note, I could certainly do faster (T5 or masscan, gawd) - but this is about as fast as I'm going to do in my environment and still be safe.

Also, only looking for open ports right now - no fingerprinting yet.

A cool thing about this approach is many intrusion detection still will only look for multiple ports on a single host to trigger an alert. Some still ignore many hosts / single port scans (to their detriment).

We've long sense purple teamed this, so I sent a notification to SOC letting them know my actions and asking them nicely (I bribed them last week) to not stop me, lol.

Should take a couple weeks to a month at this pace and in my environment to hit every single one of the just shy of 18,000,000 hosts 😂

#pentesting #hacking #infosec #penetrationtesting #blueteam #redteam #intrusionDetection

Good day everyone! The Microsoft Threat Intelligence team has discovered activity from a group known as #FlaxTyphoon. They are a nation-state group from China that targeted organizations in Taiwan. While the group leverages tools that are commonly used, like #ChinaChopper, #MetaSploit, and #Mimikatz, they also rely on abusing #LOLBINS, or Living-off-the-land binaries and scripts (tools that exist and come with the native operating system). Some of their TTPs include using registry key modification for persistence, using #powershell, #certutil, or #bitsadmin to download tools, and accessing #LSASS process memory and Security Account Manager registry hive for credential access. This is a great article that not only provides high-level details but it provides a starting point for any organization to start threat hunting by using the technical details provided! Enjoy your weekend and #HappyHunting!

#CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #readoftheday

🤦‍♂️ You know what was missing on CyberEthical so far? My recommendation for all cybersecurity enthusiasts and professionals to step up your game with HackTheBox Academy!

Yearly subscription or not - just give it a spin 🤸

🔗 https://blog.cyberethical.me/hackthebox-academy

PS. Remember about 20% discount until 30th of June 😉

#CyberEthical #cybersecurity #cyberawareness #infosecurity #infosec #blueteam #redteaming #academy #hackthebox

OffSec (tidigare Offensive Security) har släppt en ny Linux-distribution vid namn Kali Purple, läs mer här: https://kryptera.se/kali-purple-fran-offsec/

#offensivesecurity #linux #offsec #kali #cybersecurity #purpleteam #blueteaming #blueteam

Hey #soc and #blueteam, if I have to hunt for #mimikatz executed from #cobaltstrike using #osquery, what are the tables I need to correlate? Though I figured out few events from security logs, I want to use OSQUERY logs for hunting. Any suggestions?

#threathunting #threatintel