home.social

#blueteam — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #blueteam, aggregated by home.social.

  1. Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)

    In this article, I break down how the vulnerability works, affected configurations, exploitation scenarios, and the mitigation steps organizations should take to protect their remote access infrastructure.

    denizhalil.com/2026/06/02/cve-

    #CyberSecurity #PaloAlto #GlobalProtect #PANOS #CVE20260257 #VulnerabilityManagement #ThreatDetection #NetworkSecurity #BlueTeam #RedTeam #InfoSec #DenizHalil

  2. Responder Tool for Network Credential Capture in Active Directory

    In this article, I cover how Responder works, common credential capture techniques, and practical mitigation strategies for defending Active Directory environments.

    denizhalil.com/2026/05/18/resp

    #CyberSecurity #ActiveDirectory #Responder #LLMNR #NTLM #CredentialCapture #RedTeam #BlueTeam #Pentesting #WindowsSecurity #InfoSec #EthicalHacking #DenizHalil

  3. UDP Network Monitoring with C++: A Comprehensive Guide

    In this guide, I demonstrate how to build a UDP packet sniffer in C++ using raw sockets, parse packet headers, and extract key data like source/destination IPs and ports.
    denizhalil.com/2025/07/14/udp-

    #CyberSecurity #NetworkMonitoring #PacketSniffer #UDP #Cpp #NetworkSecurity #InfoSec #BlueTeam #RedTeam #InfoSec #securityengineering #denizhalil

  4. What is DCSync Attack and Mimikatz Usage in Active Directory

    One of the most critical attacks in Active Directory environments, DCSync, allows attackers to impersonate a Domain Controller and extract password hashes through replication abuse.

    #CyberSecurity #ActiveDirectory #DCSync #RedTeam #BlueTeam #InfoSec #Pentesting #SOC #ThreatDetection #WindowsSecurity #EthicalHacking #ITSecurity #NetworkSecurity #SecurityOperations #DenizHalil

    denizhalil.com/2026/03/27/dcsy

  5. 🚨 CRITICAL zero-day in CrushFTP: attackers can take over servers, risking data theft & business disruption. No patch yet — restrict access, monitor logs, and stay alert for updates. Action needed for all CrushFTP users! radar.offseq.com/threat/hacker #OffSeq #CrushFTP #ZeroDay #BlueTeam

  6. 🚨 CRITICAL zero-day in CrushFTP: attackers can take over servers, risking data theft & business disruption. No patch yet — restrict access, monitor logs, and stay alert for updates. Action needed for all CrushFTP users! radar.offseq.com/threat/hacker #OffSeq #CrushFTP #ZeroDay #BlueTeam

  7. 🚨 CRITICAL zero-day in CrushFTP: attackers can take over servers, risking data theft & business disruption. No patch yet — restrict access, monitor logs, and stay alert for updates. Action needed for all CrushFTP users! radar.offseq.com/threat/hacker #OffSeq #CrushFTP #ZeroDay #BlueTeam

  8. C'est le Jour P pour la 1ere édition de POLAR Conference présenté par CrowdStrike, conférence pour CISO, directeurs et gestionnaires en cybersécurité!

    It's P Day for the first edition for POLAR Conference presented by CrowdStrike, our conference for CISO, directors and managers in cybersecurity!

    #polar #polar2023 #polarconference #infosec #ciso #cisolife #cisoadvisor #cisoseries #cybersecurite #cybersecurity #canada #quebec #conference #cybersecuritymanagement #hacking #redteam #blueteam #management #summit #securityindustry #polar2023 #polarqc #fic #incyber #cisosummit #inforum #startup #vitrinestartup

  9. Good morning all and #happywednesday! I stumbled across this article by Secureworks which does a fantastic job at gathering artifacts the appear to better understand the #SharpHound collector that helps #BloodHound gather information. This is a great article with the trail of artifacts that come from the network and the host. This type of article always takes me back to where I started which is when I stumbled across the 'Tool Analysis Result Sheet' from the JPCERT/CC. Both are great resources and I hope you enjoy them as much as I did! Have a wonderful day and Happy Hunting!

    Sniffing Out SharpHound on its Hunt for Domain Admin
    secureworks.com/blog/sniffing-

    Tool Analysis Result Sheet
    jpcert.or.jp/english/

    #CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

  10. It's been a heck of a week, with tonnes of great research and tooling that I'm sure you're going to get a kick out of - check out our wrap-up for all the news!:

    opalsec.substack.com/p/soc-gou

    Kaspersky researchers shone a light on the Dark Web trade in Google Play Loaders - a service to help inject malware into legitimate, and supposedly vetted apps, with guarantees of >1 week up-time and the option to boost your spread with targeted Ads.

    #Nokoyawa ransomware have clearly got some talent on their team, having abused a #CLFS 0-day prior to Microsoft patching it last week - one of 5 different exploits they've used, mind you - and they appear to have a new, distinct ransomware strain in rotation, too.

    There's heaps more great threat reporting, including a report that #FIN7 and former #Conti (#FIN12/#WizardSpider) members are collaborating on a new backdoor, and a crypto-mining campaign that may be the canary in the coal mine, indicating broader uptake of BYOVD and IPFS by low-level operators.

    The #QueueJumper vulnerability from last week looks primed to explode in coming days, with a no-fix vulnerability in Microsoft Intune capping off a lousy week for Windows admins struggling to keep their networks secure.

    TOOLING. Ooooh boy, this was a good week for tooling and tradecraft, ladies and gentlemen.

    The #redteam have a new port of the SharpHound AD enumeration tool for Cobalt Strike; a great reference piece on leveraging stolen Office tokens to bypass MFA and access cloud workloads, and a list of keywords to avoid when crafting stealthy PowerShell scripts.

    The #blueteam have a script to help tweak VM settings to circumvent malware anti-analysis checks; Procmon for macOS, and a lightweight bastion host to help redirect and record traffic sent to honeypots in your network.

    This was a fun one to write up, with heaps of interesting reads and takeaways to be had. Get amongst it!

    opalsec.substack.com/p/soc-gou

    #infosec #cyber #news #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #dfir #soc #threatintel #threatintelligence #darkweb #microsoft #azure #mfa #mfabypass #cobaltstrike #bloodhound #sharphound #byovd #ipfs #intune #GooglePlay #Android #zeroday #0day

  11. A rich #training #offer at BSides Milano we have top-notch trainings, in some case for the first time in #Italy! All #in-person! The #event will be held from 4 to 8 July 2023. From 4 to 7 we will be focus on #learnitall on the 8 we will deep dive in our #amazing #conference. Ticket will be available from tonight for the trainings. We have an early bird rate until 30th April.
    Are you ready? We are!! join our group SecurityBsidesItalia #linkedin or on #discord lnkd.in/dBu7wkJG for detailed info! #cyber #threatintelligence #threatintel #cloud #redteaming #redteam #blueteam #threathunting #exploitation #secureboot #TTE #multicloud #hybridcloud #voip #Linux #Windows #LTE #baseband #deception #detection #evasion #edr #BSML23 #AWS #Azure #AzureAD #GCP #devops #cicd #RTOS #FalseFlag #HoneyNet #IDAPro #Python #reverseengineering #Ghidra #network #MITRE #TTPs #persistence #commandandcontrol #lateralmovement #osint #obfuscation #malware #malwareanalysis .
    Reserve your your spot!! lnkd.in/dZf-yyPv