#blueteam — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #blueteam, aggregated by home.social.
-
New long read, six parts, now collected in one place.
This is EDR bypass, written from the blue side. EDR can be bypassed, and it is still the best endpoint defense most of us have. Both statements are true, and the interesting work lives in the gap between them.
The series starts with what an EDR actually sees on a Windows host, follows the attacker down out of user mode and into ring 0, then comes back out to detection, incident response for when the sensor cannot be trusted, and validating that the stack holds before you need it to. Somewhere in the middle, a signed driver nobody got around to removing hands over the kernel. You may want to audit your fleet after.
The one idea I would keep if I forgot the rest. Bypass, tamper, and kill are three different problems. Treating them as one is how a risk assessment goes wrong.
Start to finish on LinkedIn. https://www.linkedin.com/pulse/edr-bypass-resilient-endpoint-detection-series-daniel-owen-v05ke/ (I know, it's a cesspool. These read without a login, at least.)
-
New long read, six parts, now collected in one place.
This is EDR bypass, written from the blue side. EDR can be bypassed, and it is still the best endpoint defense most of us have. Both statements are true, and the interesting work lives in the gap between them.
The series starts with what an EDR actually sees on a Windows host, follows the attacker down out of user mode and into ring 0, then comes back out to detection, incident response for when the sensor cannot be trusted, and validating that the stack holds before you need it to. Somewhere in the middle, a signed driver nobody got around to removing hands over the kernel. You may want to audit your fleet after.
The one idea I would keep if I forgot the rest. Bypass, tamper, and kill are three different problems. Treating them as one is how a risk assessment goes wrong.
Start to finish on LinkedIn. https://www.linkedin.com/pulse/edr-bypass-resilient-endpoint-detection-series-daniel-owen-v05ke/ (I know, it's a cesspool. These read without a login, at least.)
-
New long read, six parts, now collected in one place.
This is EDR bypass, written from the blue side. EDR can be bypassed, and it is still the best endpoint defense most of us have. Both statements are true, and the interesting work lives in the gap between them.
The series starts with what an EDR actually sees on a Windows host, follows the attacker down out of user mode and into ring 0, then comes back out to detection, incident response for when the sensor cannot be trusted, and validating that the stack holds before you need it to. Somewhere in the middle, a signed driver nobody got around to removing hands over the kernel. You may want to audit your fleet after.
The one idea I would keep if I forgot the rest. Bypass, tamper, and kill are three different problems. Treating them as one is how a risk assessment goes wrong.
Start to finish on LinkedIn. https://www.linkedin.com/pulse/edr-bypass-resilient-endpoint-detection-series-daniel-owen-v05ke/ (I know, it's a cesspool. These read without a login, at least.)
-
2026-09-28 RDP #Honeypot IOCs - 357 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 219
157.230.151.38 - 30
80.66.83.43 - 18Top ASNs:
AS201814 - 219
AS14061 - 48
AS396982 - 27Top Accounts:
hello - 288
Administr - 18
(empty) - 12Top ISPs:
MEVSPACE sp. z o.o. - 219
DigitalOcean, LLC - 48
Google LLC - 27Top Clients:
Unknown - 357Top Software:
Unknown - 357Top Keyboards:
Unknown - 357Top IP Classification:
Unknown - 219
hosting - 129
hosting & proxy - 6Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-28 RDP #Honeypot IOCs - 357 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 219
157.230.151.38 - 30
80.66.83.43 - 18Top ASNs:
AS201814 - 219
AS14061 - 48
AS396982 - 27Top Accounts:
hello - 288
Administr - 18
(empty) - 12Top ISPs:
MEVSPACE sp. z o.o. - 219
DigitalOcean, LLC - 48
Google LLC - 27Top Clients:
Unknown - 357Top Software:
Unknown - 357Top Keyboards:
Unknown - 357Top IP Classification:
Unknown - 219
hosting - 129
hosting & proxy - 6Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-28 RDP #Honeypot IOCs - 357 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 219
157.230.151.38 - 30
80.66.83.43 - 18Top ASNs:
AS201814 - 219
AS14061 - 48
AS396982 - 27Top Accounts:
hello - 288
Administr - 18
(empty) - 12Top ISPs:
MEVSPACE sp. z o.o. - 219
DigitalOcean, LLC - 48
Google LLC - 27Top Clients:
Unknown - 357Top Software:
Unknown - 357Top Keyboards:
Unknown - 357Top IP Classification:
Unknown - 219
hosting - 129
hosting & proxy - 6Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-28 RDP #Honeypot IOCs - 357 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 219
157.230.151.38 - 30
80.66.83.43 - 18Top ASNs:
AS201814 - 219
AS14061 - 48
AS396982 - 27Top Accounts:
hello - 288
Administr - 18
(empty) - 12Top ISPs:
MEVSPACE sp. z o.o. - 219
DigitalOcean, LLC - 48
Google LLC - 27Top Clients:
Unknown - 357Top Software:
Unknown - 357Top Keyboards:
Unknown - 357Top IP Classification:
Unknown - 219
hosting - 129
hosting & proxy - 6Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-28 RDP #Honeypot IOCs - 238 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 146
157.230.151.38 - 20
80.66.83.43 - 12Top ASNs:
AS201814 - 146
AS14061 - 32
AS396982 - 18Top Accounts:
hello - 192
Administr - 12
(empty) - 8Top ISPs:
MEVSPACE sp. z o.o. - 146
DigitalOcean, LLC - 32
Google LLC - 18Top Clients:
Unknown - 238Top Software:
Unknown - 238Top Keyboards:
Unknown - 238Top IP Classification:
Unknown - 146
hosting - 86
hosting & proxy - 4Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-28 RDP #Honeypot IOCs - 238 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 146
157.230.151.38 - 20
80.66.83.43 - 12Top ASNs:
AS201814 - 146
AS14061 - 32
AS396982 - 18Top Accounts:
hello - 192
Administr - 12
(empty) - 8Top ISPs:
MEVSPACE sp. z o.o. - 146
DigitalOcean, LLC - 32
Google LLC - 18Top Clients:
Unknown - 238Top Software:
Unknown - 238Top Keyboards:
Unknown - 238Top IP Classification:
Unknown - 146
hosting - 86
hosting & proxy - 4Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-28 RDP #Honeypot IOCs - 238 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 146
157.230.151.38 - 20
80.66.83.43 - 12Top ASNs:
AS201814 - 146
AS14061 - 32
AS396982 - 18Top Accounts:
hello - 192
Administr - 12
(empty) - 8Top ISPs:
MEVSPACE sp. z o.o. - 146
DigitalOcean, LLC - 32
Google LLC - 18Top Clients:
Unknown - 238Top Software:
Unknown - 238Top Keyboards:
Unknown - 238Top IP Classification:
Unknown - 146
hosting - 86
hosting & proxy - 4Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-28 RDP #Honeypot IOCs - 238 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 146
157.230.151.38 - 20
80.66.83.43 - 12Top ASNs:
AS201814 - 146
AS14061 - 32
AS396982 - 18Top Accounts:
hello - 192
Administr - 12
(empty) - 8Top ISPs:
MEVSPACE sp. z o.o. - 146
DigitalOcean, LLC - 32
Google LLC - 18Top Clients:
Unknown - 238Top Software:
Unknown - 238Top Keyboards:
Unknown - 238Top IP Classification:
Unknown - 146
hosting - 86
hosting & proxy - 4Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-28 RDP #Honeypot IOCs - 119 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 73
157.230.151.38 - 10
80.66.83.43 - 6Top ASNs:
AS201814 - 73
AS14061 - 16
AS396982 - 9Top Accounts:
hello - 96
Administr - 6
(empty) - 4Top ISPs:
MEVSPACE sp. z o.o. - 73
DigitalOcean, LLC - 16
Google LLC - 9Top Clients:
Unknown - 119Top Software:
Unknown - 119Top Keyboards:
Unknown - 119Top IP Classification:
Unknown - 73
hosting - 43
hosting & proxy - 2Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-28 RDP #Honeypot IOCs - 119 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 73
157.230.151.38 - 10
80.66.83.43 - 6Top ASNs:
AS201814 - 73
AS14061 - 16
AS396982 - 9Top Accounts:
hello - 96
Administr - 6
(empty) - 4Top ISPs:
MEVSPACE sp. z o.o. - 73
DigitalOcean, LLC - 16
Google LLC - 9Top Clients:
Unknown - 119Top Software:
Unknown - 119Top Keyboards:
Unknown - 119Top IP Classification:
Unknown - 73
hosting - 43
hosting & proxy - 2Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-28 RDP #Honeypot IOCs - 119 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 73
157.230.151.38 - 10
80.66.83.43 - 6Top ASNs:
AS201814 - 73
AS14061 - 16
AS396982 - 9Top Accounts:
hello - 96
Administr - 6
(empty) - 4Top ISPs:
MEVSPACE sp. z o.o. - 73
DigitalOcean, LLC - 16
Google LLC - 9Top Clients:
Unknown - 119Top Software:
Unknown - 119Top Keyboards:
Unknown - 119Top IP Classification:
Unknown - 73
hosting - 43
hosting & proxy - 2Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-28 RDP #Honeypot IOCs - 119 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 73
157.230.151.38 - 10
80.66.83.43 - 6Top ASNs:
AS201814 - 73
AS14061 - 16
AS396982 - 9Top Accounts:
hello - 96
Administr - 6
(empty) - 4Top ISPs:
MEVSPACE sp. z o.o. - 73
DigitalOcean, LLC - 16
Google LLC - 9Top Clients:
Unknown - 119Top Software:
Unknown - 119Top Keyboards:
Unknown - 119Top IP Classification:
Unknown - 73
hosting - 43
hosting & proxy - 2Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-27 RDP #Honeypot IOCs - 324 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 156
157.20.240.38 - 33
216.226.76.20 - 30Top ASNs:
AS201814 - 156
AS396982 - 36
AS152565 - 33Top Accounts:
hello - 219
Administr - 15
eltons - 15Top ISPs:
MEVSPACE sp. z o.o. - 156
Google LLC - 36
JOY SERVICES - 33Top Clients:
Unknown - 324Top Software:
Unknown - 324Top Keyboards:
Unknown - 324Top IP Classification:
Unknown - 222
hosting - 93
hosting & proxy - 9Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-27 RDP #Honeypot IOCs - 324 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 156
157.20.240.38 - 33
216.226.76.20 - 30Top ASNs:
AS201814 - 156
AS396982 - 36
AS152565 - 33Top Accounts:
hello - 219
Administr - 15
eltons - 15Top ISPs:
MEVSPACE sp. z o.o. - 156
Google LLC - 36
JOY SERVICES - 33Top Clients:
Unknown - 324Top Software:
Unknown - 324Top Keyboards:
Unknown - 324Top IP Classification:
Unknown - 222
hosting - 93
hosting & proxy - 9Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-27 RDP #Honeypot IOCs - 324 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 156
157.20.240.38 - 33
216.226.76.20 - 30Top ASNs:
AS201814 - 156
AS396982 - 36
AS152565 - 33Top Accounts:
hello - 219
Administr - 15
eltons - 15Top ISPs:
MEVSPACE sp. z o.o. - 156
Google LLC - 36
JOY SERVICES - 33Top Clients:
Unknown - 324Top Software:
Unknown - 324Top Keyboards:
Unknown - 324Top IP Classification:
Unknown - 222
hosting - 93
hosting & proxy - 9Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-27 RDP #Honeypot IOCs - 324 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 156
157.20.240.38 - 33
216.226.76.20 - 30Top ASNs:
AS201814 - 156
AS396982 - 36
AS152565 - 33Top Accounts:
hello - 219
Administr - 15
eltons - 15Top ISPs:
MEVSPACE sp. z o.o. - 156
Google LLC - 36
JOY SERVICES - 33Top Clients:
Unknown - 324Top Software:
Unknown - 324Top Keyboards:
Unknown - 324Top IP Classification:
Unknown - 222
hosting - 93
hosting & proxy - 9Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-27 RDP #Honeypot IOCs - 216 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 104
157.20.240.38 - 22
216.226.76.20 - 20Top ASNs:
AS201814 - 104
AS396982 - 24
AS152565 - 22Top Accounts:
hello - 146
Administr - 10
eltons - 10Top ISPs:
MEVSPACE sp. z o.o. - 104
Google LLC - 24
JOY SERVICES - 22Top Clients:
Unknown - 216Top Software:
Unknown - 216Top Keyboards:
Unknown - 216Top IP Classification:
Unknown - 148
hosting - 62
hosting & proxy - 6Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-27 RDP #Honeypot IOCs - 216 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 104
157.20.240.38 - 22
216.226.76.20 - 20Top ASNs:
AS201814 - 104
AS396982 - 24
AS152565 - 22Top Accounts:
hello - 146
Administr - 10
eltons - 10Top ISPs:
MEVSPACE sp. z o.o. - 104
Google LLC - 24
JOY SERVICES - 22Top Clients:
Unknown - 216Top Software:
Unknown - 216Top Keyboards:
Unknown - 216Top IP Classification:
Unknown - 148
hosting - 62
hosting & proxy - 6Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-27 RDP #Honeypot IOCs - 216 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 104
157.20.240.38 - 22
216.226.76.20 - 20Top ASNs:
AS201814 - 104
AS396982 - 24
AS152565 - 22Top Accounts:
hello - 146
Administr - 10
eltons - 10Top ISPs:
MEVSPACE sp. z o.o. - 104
Google LLC - 24
JOY SERVICES - 22Top Clients:
Unknown - 216Top Software:
Unknown - 216Top Keyboards:
Unknown - 216Top IP Classification:
Unknown - 148
hosting - 62
hosting & proxy - 6Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-27 RDP #Honeypot IOCs - 216 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 104
157.20.240.38 - 22
216.226.76.20 - 20Top ASNs:
AS201814 - 104
AS396982 - 24
AS152565 - 22Top Accounts:
hello - 146
Administr - 10
eltons - 10Top ISPs:
MEVSPACE sp. z o.o. - 104
Google LLC - 24
JOY SERVICES - 22Top Clients:
Unknown - 216Top Software:
Unknown - 216Top Keyboards:
Unknown - 216Top IP Classification:
Unknown - 148
hosting - 62
hosting & proxy - 6Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-27 RDP #Honeypot IOCs - 108 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 52
157.20.240.38 - 11
216.226.76.20 - 10Top ASNs:
AS201814 - 52
AS396982 - 12
AS152565 - 11Top Accounts:
hello - 73
Administr - 5
eltons - 5Top ISPs:
MEVSPACE sp. z o.o. - 52
Google LLC - 12
JOY SERVICES - 11Top Clients:
Unknown - 108Top Software:
Unknown - 108Top Keyboards:
Unknown - 108Top IP Classification:
Unknown - 74
hosting - 31
hosting & proxy - 3Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-27 RDP #Honeypot IOCs - 108 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 52
157.20.240.38 - 11
216.226.76.20 - 10Top ASNs:
AS201814 - 52
AS396982 - 12
AS152565 - 11Top Accounts:
hello - 73
Administr - 5
eltons - 5Top ISPs:
MEVSPACE sp. z o.o. - 52
Google LLC - 12
JOY SERVICES - 11Top Clients:
Unknown - 108Top Software:
Unknown - 108Top Keyboards:
Unknown - 108Top IP Classification:
Unknown - 74
hosting - 31
hosting & proxy - 3Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-27 RDP #Honeypot IOCs - 108 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 52
157.20.240.38 - 11
216.226.76.20 - 10Top ASNs:
AS201814 - 52
AS396982 - 12
AS152565 - 11Top Accounts:
hello - 73
Administr - 5
eltons - 5Top ISPs:
MEVSPACE sp. z o.o. - 52
Google LLC - 12
JOY SERVICES - 11Top Clients:
Unknown - 108Top Software:
Unknown - 108Top Keyboards:
Unknown - 108Top IP Classification:
Unknown - 74
hosting - 31
hosting & proxy - 3Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-27 RDP #Honeypot IOCs - 108 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
94.26.68.55 - 52
157.20.240.38 - 11
216.226.76.20 - 10Top ASNs:
AS201814 - 52
AS396982 - 12
AS152565 - 11Top Accounts:
hello - 73
Administr - 5
eltons - 5Top ISPs:
MEVSPACE sp. z o.o. - 52
Google LLC - 12
JOY SERVICES - 11Top Clients:
Unknown - 108Top Software:
Unknown - 108Top Keyboards:
Unknown - 108Top IP Classification:
Unknown - 74
hosting - 31
hosting & proxy - 3Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key