home.social

#blueteam — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #blueteam, aggregated by home.social.

  1. What started as a project out of vendor frustration and spite, became a plucky git repo to nerf cyber crime riding trusted services. I'm so happy when defenders tell me how BS Lists helped them in their $job.

    Similar to LOLRMM, LOTT, and ClickGrab, it's a passion project maintained by a single individual. [ xkcd.gif ] And this model puts these projects at-risk long-term.

    Because the author of BS Lists apparently can't be bothered to wear his helmet during rock and icefall danger, new lists will be published on IFIN, a 501(c)(3) cyber intel non-profit. Older lists will be migrated where appropriate.

    With this announcement, there is a 2050 domain-strong RPC Node list to combat #Etherhiding I encourage defenders to check out.

    lists.ifin.network/lists/rpc-n

    I also have 3 more lists in queue.

    #cybersecurity #blocklist #blueteam

  2. 2026-09-12 RDP #Honeypot IOCs - 34326 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    14.225.19.59 - 30099
    147.182.250.28 - 4032
    104.64.217.122 - 60

    Top ASNs:
    AS135905 - 30099
    AS14061 - 4050
    AS63949 - 66

    Top Accounts:
    hello - 34233
    Administr - 33
    anonymous - 9

    Top ISPs:
    Vietnam Posts and Telecommunications Group - 30099
    DigitalOcean, LLC - 4050
    Akamai Technologies, Inc. - 66

    Top Clients:
    Unknown - 34326

    Top Software:
    Unknown - 34326

    Top Keyboards:
    Unknown - 34326

    Top IP Classification:
    Unknown - 30114
    hosting - 4212

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

  3. 2026-09-12 RDP #Honeypot IOCs - 34326 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    14.225.19.59 - 30099
    147.182.250.28 - 4032
    104.64.217.122 - 60

    Top ASNs:
    AS135905 - 30099
    AS14061 - 4050
    AS63949 - 66

    Top Accounts:
    hello - 34233
    Administr - 33
    anonymous - 9

    Top ISPs:
    Vietnam Posts and Telecommunications Group - 30099
    DigitalOcean, LLC - 4050
    Akamai Technologies, Inc. - 66

    Top Clients:
    Unknown - 34326

    Top Software:
    Unknown - 34326

    Top Keyboards:
    Unknown - 34326

    Top IP Classification:
    Unknown - 30114
    hosting - 4212

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

  4. 2026-09-12 RDP #Honeypot IOCs - 34326 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    14.225.19.59 - 30099
    147.182.250.28 - 4032
    104.64.217.122 - 60

    Top ASNs:
    AS135905 - 30099
    AS14061 - 4050
    AS63949 - 66

    Top Accounts:
    hello - 34233
    Administr - 33
    anonymous - 9

    Top ISPs:
    Vietnam Posts and Telecommunications Group - 30099
    DigitalOcean, LLC - 4050
    Akamai Technologies, Inc. - 66

    Top Clients:
    Unknown - 34326

    Top Software:
    Unknown - 34326

    Top Keyboards:
    Unknown - 34326

    Top IP Classification:
    Unknown - 30114
    hosting - 4212

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

  5. 2026-09-12 RDP #Honeypot IOCs - 34326 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    14.225.19.59 - 30099
    147.182.250.28 - 4032
    104.64.217.122 - 60

    Top ASNs:
    AS135905 - 30099
    AS14061 - 4050
    AS63949 - 66

    Top Accounts:
    hello - 34233
    Administr - 33
    anonymous - 9

    Top ISPs:
    Vietnam Posts and Telecommunications Group - 30099
    DigitalOcean, LLC - 4050
    Akamai Technologies, Inc. - 66

    Top Clients:
    Unknown - 34326

    Top Software:
    Unknown - 34326

    Top Keyboards:
    Unknown - 34326

    Top IP Classification:
    Unknown - 30114
    hosting - 4212

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

  6. 2026-09-12 RDP #Honeypot IOCs - 34324 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    14.225.19.59 - 30097
    147.182.250.28 - 4032
    104.64.217.122 - 60

    Top ASNs:
    AS135905 - 30097
    AS14061 - 4050
    AS63949 - 66

    Top Accounts:
    hello - 34231
    Administr - 33
    anonymous - 9

    Top ISPs:
    Vietnam Posts and Telecommunications Group - 30097
    DigitalOcean, LLC - 4050
    Akamai Technologies, Inc. - 66

    Top Clients:
    Unknown - 34324

    Top Software:
    Unknown - 34324

    Top Keyboards:
    Unknown - 34324

    Top IP Classification:
    Unknown - 30112
    hosting - 4212

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

  7. 2026-09-12 RDP #Honeypot IOCs - 34324 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    14.225.19.59 - 30097
    147.182.250.28 - 4032
    104.64.217.122 - 60

    Top ASNs:
    AS135905 - 30097
    AS14061 - 4050
    AS63949 - 66

    Top Accounts:
    hello - 34231
    Administr - 33
    anonymous - 9

    Top ISPs:
    Vietnam Posts and Telecommunications Group - 30097
    DigitalOcean, LLC - 4050
    Akamai Technologies, Inc. - 66

    Top Clients:
    Unknown - 34324

    Top Software:
    Unknown - 34324

    Top Keyboards:
    Unknown - 34324

    Top IP Classification:
    Unknown - 30112
    hosting - 4212

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

  8. 2026-09-12 RDP #Honeypot IOCs - 34324 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    14.225.19.59 - 30097
    147.182.250.28 - 4032
    104.64.217.122 - 60

    Top ASNs:
    AS135905 - 30097
    AS14061 - 4050
    AS63949 - 66

    Top Accounts:
    hello - 34231
    Administr - 33
    anonymous - 9

    Top ISPs:
    Vietnam Posts and Telecommunications Group - 30097
    DigitalOcean, LLC - 4050
    Akamai Technologies, Inc. - 66

    Top Clients:
    Unknown - 34324

    Top Software:
    Unknown - 34324

    Top Keyboards:
    Unknown - 34324

    Top IP Classification:
    Unknown - 30112
    hosting - 4212

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

  9. 2026-09-12 RDP #Honeypot IOCs - 34324 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    14.225.19.59 - 30097
    147.182.250.28 - 4032
    104.64.217.122 - 60

    Top ASNs:
    AS135905 - 30097
    AS14061 - 4050
    AS63949 - 66

    Top Accounts:
    hello - 34231
    Administr - 33
    anonymous - 9

    Top ISPs:
    Vietnam Posts and Telecommunications Group - 30097
    DigitalOcean, LLC - 4050
    Akamai Technologies, Inc. - 66

    Top Clients:
    Unknown - 34324

    Top Software:
    Unknown - 34324

    Top Keyboards:
    Unknown - 34324

    Top IP Classification:
    Unknown - 30112
    hosting - 4212

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

  10. 2026-09-12 RDP #Honeypot IOCs - 34322 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    14.225.19.59 - 30095
    147.182.250.28 - 4032
    104.64.217.122 - 60

    Top ASNs:
    AS135905 - 30095
    AS14061 - 4050
    AS63949 - 66

    Top Accounts:
    hello - 34229
    Administr - 33
    anonymous - 9

    Top ISPs:
    Vietnam Posts and Telecommunications Group - 30095
    DigitalOcean, LLC - 4050
    Akamai Technologies, Inc. - 66

    Top Clients:
    Unknown - 34322

    Top Software:
    Unknown - 34322

    Top Keyboards:
    Unknown - 34322

    Top IP Classification:
    Unknown - 30110
    hosting - 4212

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

  11. 2026-09-12 RDP #Honeypot IOCs - 34322 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    14.225.19.59 - 30095
    147.182.250.28 - 4032
    104.64.217.122 - 60

    Top ASNs:
    AS135905 - 30095
    AS14061 - 4050
    AS63949 - 66

    Top Accounts:
    hello - 34229
    Administr - 33
    anonymous - 9

    Top ISPs:
    Vietnam Posts and Telecommunications Group - 30095
    DigitalOcean, LLC - 4050
    Akamai Technologies, Inc. - 66

    Top Clients:
    Unknown - 34322

    Top Software:
    Unknown - 34322

    Top Keyboards:
    Unknown - 34322

    Top IP Classification:
    Unknown - 30110
    hosting - 4212

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

  12. 2026-09-12 RDP #Honeypot IOCs - 34322 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    14.225.19.59 - 30095
    147.182.250.28 - 4032
    104.64.217.122 - 60

    Top ASNs:
    AS135905 - 30095
    AS14061 - 4050
    AS63949 - 66

    Top Accounts:
    hello - 34229
    Administr - 33
    anonymous - 9

    Top ISPs:
    Vietnam Posts and Telecommunications Group - 30095
    DigitalOcean, LLC - 4050
    Akamai Technologies, Inc. - 66

    Top Clients:
    Unknown - 34322

    Top Software:
    Unknown - 34322

    Top Keyboards:
    Unknown - 34322

    Top IP Classification:
    Unknown - 30110
    hosting - 4212

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

  13. 2026-09-12 RDP #Honeypot IOCs - 34322 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    14.225.19.59 - 30095
    147.182.250.28 - 4032
    104.64.217.122 - 60

    Top ASNs:
    AS135905 - 30095
    AS14061 - 4050
    AS63949 - 66

    Top Accounts:
    hello - 34229
    Administr - 33
    anonymous - 9

    Top ISPs:
    Vietnam Posts and Telecommunications Group - 30095
    DigitalOcean, LLC - 4050
    Akamai Technologies, Inc. - 66

    Top Clients:
    Unknown - 34322

    Top Software:
    Unknown - 34322

    Top Keyboards:
    Unknown - 34322

    Top IP Classification:
    Unknown - 30110
    hosting - 4212

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

  14. Presentation mode: ON. 🚀
    Talking all things #ZeroTrust and #PAM this afternoon. In a world of persistent threats, "Never Trust, Always Verify" isn't just a slogan, it's the only way to survive. Who else is rethinking their access controls today? 🔒

    #CyberSecurity #Identity #BlueTeam #SysAdmin #PrivilegedAccess

  15. Как одна форма обратной связи привела к компрометации helpdesk-учетки банка

    Всем привет! Меня зовут Игорь Панарин, я же m0nr0e21 . Руковожу направлением анализа защищённости инфраструктуры в Дирекции по информационной безопасности РАНХиГС. Мы работаем с распределённой инфраструктурой: офисы, филиалы, ЦОДы — много площадок и зон ответственности. В такой среде важно не просто находить уязвимости, а наводить порядок в процессах, выстраивать понятное управление и делать безопасность системной, а не точечной. В этой статье я разберу, как проходил взлом банковского сегмента на полигоне Standoff Hackbase, какие векторы атак сработали и какие практические выводы из этого стоит сделать специалистам по безопасности. Мы делаем большую системную работу — и иногда полезно выйти «в поле», чтобы убедиться, что защита действительно готова к бою.

    habr.com/ru/companies/pt/artic

    #helpdesk #blueteam #standoff #hackbase #rdp #ssh #безопасность_вебприложений #банк #кибератаки #уязвимости_и_их_эксплуатация

  16. Успешная атака по кусочкам: тестируем фреймворки кибербезопастности MITRE ATT&CK и Cyber Kill Chain

    Статья напраленна на анализ кибератаки, основанный на использовании всемиизвестными фрэймворками: MITRE ATT&CK и Cyber Kill Chain . Публикация напасана с целью, рассматреть, как эти модели дополняют друг друга, помогая выявлять уязвимости в защите, улучшить процессы обнаружения и реагирования на угрозы. Статья будет полезна специалистам по информационной безопасности, аналитикам угроз и всем, кто интересуется современными подходами к анализу кибератак.

    habr.com/ru/articles/886972/

    #MITRE_ATTACK #CyberKillChain #ИнформационнаяБезопасность #кибербезопасность #ThreatAnalysis #ThreatIntelligence #SOC #redteam #blueteam #IncidentResponse