#blueteam — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #blueteam, aggregated by home.social.
-
PaperCut NG/MF hit by CRITICAL zero-days (CVE-2026-82078, CVE-2026-81578) exploited in AI-driven attacks. Remote code exec, credential theft, & domain admin escalation seen on 440+ deployments. Patch ASAP. Details: https://radar.offseq.com/threat/papercut-flaws-exploited-in-ai-powered-attacks-2193db246901da9f #OffSeq #PaperCut #ZeroDay #BlueTeam
-
PaperCut NG/MF hit by CRITICAL zero-days (CVE-2026-82078, CVE-2026-81578) exploited in AI-driven attacks. Remote code exec, credential theft, & domain admin escalation seen on 440+ deployments. Patch ASAP. Details: https://radar.offseq.com/threat/papercut-flaws-exploited-in-ai-powered-attacks-2193db246901da9f #OffSeq #PaperCut #ZeroDay #BlueTeam
-
PaperCut NG/MF hit by CRITICAL zero-days (CVE-2026-82078, CVE-2026-81578) exploited in AI-driven attacks. Remote code exec, credential theft, & domain admin escalation seen on 440+ deployments. Patch ASAP. Details: https://radar.offseq.com/threat/papercut-flaws-exploited-in-ai-powered-attacks-2193db246901da9f #OffSeq #PaperCut #ZeroDay #BlueTeam
-
PaperCut NG/MF hit by CRITICAL zero-days (CVE-2026-82078, CVE-2026-81578) exploited in AI-driven attacks. Remote code exec, credential theft, & domain admin escalation seen on 440+ deployments. Patch ASAP. Details: https://radar.offseq.com/threat/papercut-flaws-exploited-in-ai-powered-attacks-2193db246901da9f #OffSeq #PaperCut #ZeroDay #BlueTeam
-
2026-09-10 RDP #Honeypot IOCs - 2139 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
14.225.19.59 - 2001
165.22.57.45 - 18
80.66.83.43 - 18Top ASNs:
AS135905 - 2001
AS14061 - 39
AS396982 - 27Top Accounts:
hello - 2046
Administr - 27
Test - 9Top ISPs:
Vietnam Posts and Telecommunications Group - 2001
DigitalOcean, LLC - 39
Google LLC - 27Top Clients:
Unknown - 2139Top Software:
Unknown - 2139Top Keyboards:
Unknown - 2139Top IP Classification:
Unknown - 2016
hosting - 120
hosting & proxy - 3Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-10 RDP #Honeypot IOCs - 2139 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
14.225.19.59 - 2001
165.22.57.45 - 18
80.66.83.43 - 18Top ASNs:
AS135905 - 2001
AS14061 - 39
AS396982 - 27Top Accounts:
hello - 2046
Administr - 27
Test - 9Top ISPs:
Vietnam Posts and Telecommunications Group - 2001
DigitalOcean, LLC - 39
Google LLC - 27Top Clients:
Unknown - 2139Top Software:
Unknown - 2139Top Keyboards:
Unknown - 2139Top IP Classification:
Unknown - 2016
hosting - 120
hosting & proxy - 3Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-10 RDP #Honeypot IOCs - 2139 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
14.225.19.59 - 2001
165.22.57.45 - 18
80.66.83.43 - 18Top ASNs:
AS135905 - 2001
AS14061 - 39
AS396982 - 27Top Accounts:
hello - 2046
Administr - 27
Test - 9Top ISPs:
Vietnam Posts and Telecommunications Group - 2001
DigitalOcean, LLC - 39
Google LLC - 27Top Clients:
Unknown - 2139Top Software:
Unknown - 2139Top Keyboards:
Unknown - 2139Top IP Classification:
Unknown - 2016
hosting - 120
hosting & proxy - 3Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-10 RDP #Honeypot IOCs - 2139 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
14.225.19.59 - 2001
165.22.57.45 - 18
80.66.83.43 - 18Top ASNs:
AS135905 - 2001
AS14061 - 39
AS396982 - 27Top Accounts:
hello - 2046
Administr - 27
Test - 9Top ISPs:
Vietnam Posts and Telecommunications Group - 2001
DigitalOcean, LLC - 39
Google LLC - 27Top Clients:
Unknown - 2139Top Software:
Unknown - 2139Top Keyboards:
Unknown - 2139Top IP Classification:
Unknown - 2016
hosting - 120
hosting & proxy - 3Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-10 RDP #Honeypot IOCs - 1426 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
14.225.19.59 - 1334
165.22.57.45 - 12
80.66.83.43 - 12Top ASNs:
AS135905 - 1334
AS14061 - 26
AS396982 - 18Top Accounts:
hello - 1364
Administr - 18
Test - 6Top ISPs:
Vietnam Posts and Telecommunications Group - 1334
DigitalOcean, LLC - 26
Google LLC - 18Top Clients:
Unknown - 1426Top Software:
Unknown - 1426Top Keyboards:
Unknown - 1426Top IP Classification:
Unknown - 1344
hosting - 80
hosting & proxy - 2Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-10 RDP #Honeypot IOCs - 1426 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
14.225.19.59 - 1334
165.22.57.45 - 12
80.66.83.43 - 12Top ASNs:
AS135905 - 1334
AS14061 - 26
AS396982 - 18Top Accounts:
hello - 1364
Administr - 18
Test - 6Top ISPs:
Vietnam Posts and Telecommunications Group - 1334
DigitalOcean, LLC - 26
Google LLC - 18Top Clients:
Unknown - 1426Top Software:
Unknown - 1426Top Keyboards:
Unknown - 1426Top IP Classification:
Unknown - 1344
hosting - 80
hosting & proxy - 2Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-10 RDP #Honeypot IOCs - 1426 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
14.225.19.59 - 1334
165.22.57.45 - 12
80.66.83.43 - 12Top ASNs:
AS135905 - 1334
AS14061 - 26
AS396982 - 18Top Accounts:
hello - 1364
Administr - 18
Test - 6Top ISPs:
Vietnam Posts and Telecommunications Group - 1334
DigitalOcean, LLC - 26
Google LLC - 18Top Clients:
Unknown - 1426Top Software:
Unknown - 1426Top Keyboards:
Unknown - 1426Top IP Classification:
Unknown - 1344
hosting - 80
hosting & proxy - 2Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-10 RDP #Honeypot IOCs - 1426 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
14.225.19.59 - 1334
165.22.57.45 - 12
80.66.83.43 - 12Top ASNs:
AS135905 - 1334
AS14061 - 26
AS396982 - 18Top Accounts:
hello - 1364
Administr - 18
Test - 6Top ISPs:
Vietnam Posts and Telecommunications Group - 1334
DigitalOcean, LLC - 26
Google LLC - 18Top Clients:
Unknown - 1426Top Software:
Unknown - 1426Top Keyboards:
Unknown - 1426Top IP Classification:
Unknown - 1344
hosting - 80
hosting & proxy - 2Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-10 RDP #Honeypot IOCs - 713 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
14.225.19.59 - 667
165.22.57.45 - 6
80.66.83.43 - 6Top ASNs:
AS135905 - 667
AS14061 - 13
AS396982 - 9Top Accounts:
hello - 682
Administr - 9
Test - 3Top ISPs:
Vietnam Posts and Telecommunications Group - 667
DigitalOcean, LLC - 13
Google LLC - 9Top Clients:
Unknown - 713Top Software:
Unknown - 713Top Keyboards:
Unknown - 713Top IP Classification:
Unknown - 672
hosting - 40
hosting & proxy - 1Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-10 RDP #Honeypot IOCs - 713 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
14.225.19.59 - 667
165.22.57.45 - 6
80.66.83.43 - 6Top ASNs:
AS135905 - 667
AS14061 - 13
AS396982 - 9Top Accounts:
hello - 682
Administr - 9
Test - 3Top ISPs:
Vietnam Posts and Telecommunications Group - 667
DigitalOcean, LLC - 13
Google LLC - 9Top Clients:
Unknown - 713Top Software:
Unknown - 713Top Keyboards:
Unknown - 713Top IP Classification:
Unknown - 672
hosting - 40
hosting & proxy - 1Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-10 RDP #Honeypot IOCs - 713 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
14.225.19.59 - 667
165.22.57.45 - 6
80.66.83.43 - 6Top ASNs:
AS135905 - 667
AS14061 - 13
AS396982 - 9Top Accounts:
hello - 682
Administr - 9
Test - 3Top ISPs:
Vietnam Posts and Telecommunications Group - 667
DigitalOcean, LLC - 13
Google LLC - 9Top Clients:
Unknown - 713Top Software:
Unknown - 713Top Keyboards:
Unknown - 713Top IP Classification:
Unknown - 672
hosting - 40
hosting & proxy - 1Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-10 RDP #Honeypot IOCs - 713 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
14.225.19.59 - 667
165.22.57.45 - 6
80.66.83.43 - 6Top ASNs:
AS135905 - 667
AS14061 - 13
AS396982 - 9Top Accounts:
hello - 682
Administr - 9
Test - 3Top ISPs:
Vietnam Posts and Telecommunications Group - 667
DigitalOcean, LLC - 13
Google LLC - 9Top Clients:
Unknown - 713Top Software:
Unknown - 713Top Keyboards:
Unknown - 713Top IP Classification:
Unknown - 672
hosting - 40
hosting & proxy - 1Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
SafeLine : un WAF prêt à protéger vos applis web des bots malveillants https://www.it-connect.fr/safeline-waf-prise-en-main/ #Cybersécurité #BlueTeam
-
2026-09-09 RDP #Honeypot IOCs - 5919 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
152.42.198.23 - 3300
168.144.34.49 - 2499
80.66.83.43 - 18Top ASNs:
AS14061 - 5817
AS396982 - 42
AS216473 - 18Top Accounts:
hello - 5850
Administr - 18
Test - 6Top ISPs:
DigitalOcean, LLC - 5817
Google LLC - 42
Bashinskii Vadim Ruslanovich - 18Top Clients:
Unknown - 5919Top Software:
Unknown - 5919Top Keyboards:
Unknown - 5919Top IP Classification:
hosting - 5910
Unknown - 6
hosting & proxy - 3Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-09 RDP #Honeypot IOCs - 5919 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
152.42.198.23 - 3300
168.144.34.49 - 2499
80.66.83.43 - 18Top ASNs:
AS14061 - 5817
AS396982 - 42
AS216473 - 18Top Accounts:
hello - 5850
Administr - 18
Test - 6Top ISPs:
DigitalOcean, LLC - 5817
Google LLC - 42
Bashinskii Vadim Ruslanovich - 18Top Clients:
Unknown - 5919Top Software:
Unknown - 5919Top Keyboards:
Unknown - 5919Top IP Classification:
hosting - 5910
Unknown - 6
hosting & proxy - 3Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-09 RDP #Honeypot IOCs - 5919 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
152.42.198.23 - 3300
168.144.34.49 - 2499
80.66.83.43 - 18Top ASNs:
AS14061 - 5817
AS396982 - 42
AS216473 - 18Top Accounts:
hello - 5850
Administr - 18
Test - 6Top ISPs:
DigitalOcean, LLC - 5817
Google LLC - 42
Bashinskii Vadim Ruslanovich - 18Top Clients:
Unknown - 5919Top Software:
Unknown - 5919Top Keyboards:
Unknown - 5919Top IP Classification:
hosting - 5910
Unknown - 6
hosting & proxy - 3Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-09 RDP #Honeypot IOCs - 5919 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
152.42.198.23 - 3300
168.144.34.49 - 2499
80.66.83.43 - 18Top ASNs:
AS14061 - 5817
AS396982 - 42
AS216473 - 18Top Accounts:
hello - 5850
Administr - 18
Test - 6Top ISPs:
DigitalOcean, LLC - 5817
Google LLC - 42
Bashinskii Vadim Ruslanovich - 18Top Clients:
Unknown - 5919Top Software:
Unknown - 5919Top Keyboards:
Unknown - 5919Top IP Classification:
hosting - 5910
Unknown - 6
hosting & proxy - 3Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-09 RDP #Honeypot IOCs - 3946 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
152.42.198.23 - 2200
168.144.34.49 - 1666
80.66.83.43 - 12Top ASNs:
AS14061 - 3878
AS396982 - 28
AS216473 - 12Top Accounts:
hello - 3900
Administr - 12
Test - 4Top ISPs:
DigitalOcean, LLC - 3878
Google LLC - 28
Bashinskii Vadim Ruslanovich - 12Top Clients:
Unknown - 3946Top Software:
Unknown - 3946Top Keyboards:
Unknown - 3946Top IP Classification:
hosting - 3940
Unknown - 4
hosting & proxy - 2Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-09 RDP #Honeypot IOCs - 3946 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
152.42.198.23 - 2200
168.144.34.49 - 1666
80.66.83.43 - 12Top ASNs:
AS14061 - 3878
AS396982 - 28
AS216473 - 12Top Accounts:
hello - 3900
Administr - 12
Test - 4Top ISPs:
DigitalOcean, LLC - 3878
Google LLC - 28
Bashinskii Vadim Ruslanovich - 12Top Clients:
Unknown - 3946Top Software:
Unknown - 3946Top Keyboards:
Unknown - 3946Top IP Classification:
hosting - 3940
Unknown - 4
hosting & proxy - 2Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-09 RDP #Honeypot IOCs - 3946 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
152.42.198.23 - 2200
168.144.34.49 - 1666
80.66.83.43 - 12Top ASNs:
AS14061 - 3878
AS396982 - 28
AS216473 - 12Top Accounts:
hello - 3900
Administr - 12
Test - 4Top ISPs:
DigitalOcean, LLC - 3878
Google LLC - 28
Bashinskii Vadim Ruslanovich - 12Top Clients:
Unknown - 3946Top Software:
Unknown - 3946Top Keyboards:
Unknown - 3946Top IP Classification:
hosting - 3940
Unknown - 4
hosting & proxy - 2Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-09 RDP #Honeypot IOCs - 3946 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
152.42.198.23 - 2200
168.144.34.49 - 1666
80.66.83.43 - 12Top ASNs:
AS14061 - 3878
AS396982 - 28
AS216473 - 12Top Accounts:
hello - 3900
Administr - 12
Test - 4Top ISPs:
DigitalOcean, LLC - 3878
Google LLC - 28
Bashinskii Vadim Ruslanovich - 12Top Clients:
Unknown - 3946Top Software:
Unknown - 3946Top Keyboards:
Unknown - 3946Top IP Classification:
hosting - 3940
Unknown - 4
hosting & proxy - 2Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-09 RDP #Honeypot IOCs - 1973 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
152.42.198.23 - 1100
168.144.34.49 - 833
80.66.83.43 - 6Top ASNs:
AS14061 - 1939
AS396982 - 14
AS216473 - 6Top Accounts:
hello - 1950
Administr - 6
Test - 2Top ISPs:
DigitalOcean, LLC - 1939
Google LLC - 14
Bashinskii Vadim Ruslanovich - 6Top Clients:
Unknown - 1973Top Software:
Unknown - 1973Top Keyboards:
Unknown - 1973Top IP Classification:
hosting - 1970
Unknown - 2
hosting & proxy - 1Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-09 RDP #Honeypot IOCs - 1973 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
152.42.198.23 - 1100
168.144.34.49 - 833
80.66.83.43 - 6Top ASNs:
AS14061 - 1939
AS396982 - 14
AS216473 - 6Top Accounts:
hello - 1950
Administr - 6
Test - 2Top ISPs:
DigitalOcean, LLC - 1939
Google LLC - 14
Bashinskii Vadim Ruslanovich - 6Top Clients:
Unknown - 1973Top Software:
Unknown - 1973Top Keyboards:
Unknown - 1973Top IP Classification:
hosting - 1970
Unknown - 2
hosting & proxy - 1Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-09 RDP #Honeypot IOCs - 1973 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
152.42.198.23 - 1100
168.144.34.49 - 833
80.66.83.43 - 6Top ASNs:
AS14061 - 1939
AS396982 - 14
AS216473 - 6Top Accounts:
hello - 1950
Administr - 6
Test - 2Top ISPs:
DigitalOcean, LLC - 1939
Google LLC - 14
Bashinskii Vadim Ruslanovich - 6Top Clients:
Unknown - 1973Top Software:
Unknown - 1973Top Keyboards:
Unknown - 1973Top IP Classification:
hosting - 1970
Unknown - 2
hosting & proxy - 1Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
2026-09-09 RDP #Honeypot IOCs - 1973 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSecTop IPs:
152.42.198.23 - 1100
168.144.34.49 - 833
80.66.83.43 - 6Top ASNs:
AS14061 - 1939
AS396982 - 14
AS216473 - 6Top Accounts:
hello - 1950
Administr - 6
Test - 2Top ISPs:
DigitalOcean, LLC - 1939
Google LLC - 14
Bashinskii Vadim Ruslanovich - 6Top Clients:
Unknown - 1973Top Software:
Unknown - 1973Top Keyboards:
Unknown - 1973Top IP Classification:
hosting - 1970
Unknown - 2
hosting & proxy - 1Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key -
New post: Detecting Misuse with the Claude Compliance API 🔍
Mapping the Compliance API feed to your SIEM gets you IAM and access detections “for free”, but the real AI threats live in the message content: prompt injection, jailbreaks, exfiltration prep, shadow data flow.
So I built a prefilter → LLM judge → SIEM pipeline to catch them, with a working repo + Sigma rules to run offline.
-
SSH Tunneling and Port Forwarding Techniques: A Comprehensive Guide
In this article, I cover:
* How SSH tunneling works under the hood
* Local, remote, and dynamic port forwarding techniques
* Real-world use cases (databases, internal services, pivoting)
* Security risks and hardening recommendationshttps://denizhalil.com/2026/02/02/ssh-tunneling-port-forwarding-guide/
#CyberSecurity #sshtunneling #portforwarding #NetworkSecurity #Linux #RedTeam #BlueTeam #Pentesting #InfoSec #securityengineering #EthicalHacking #ITSecurity
-
SSH Tunneling and Port Forwarding Techniques: A Comprehensive Guide
In this article, I cover:
* How SSH tunneling works under the hood
* Local, remote, and dynamic port forwarding techniques
* Real-world use cases (databases, internal services, pivoting)
* Security risks and hardening recommendationshttps://denizhalil.com/2026/02/02/ssh-tunneling-port-forwarding-guide/
#CyberSecurity #sshtunneling #portforwarding #NetworkSecurity #Linux #RedTeam #BlueTeam #Pentesting #InfoSec #securityengineering #EthicalHacking #ITSecurity
-
We're excited to announce that the Call for Trainers is now OPEN for DEF CON Training Las Vegas at DEF CON 34!
Are you passionate about cybersecurity, hacking, and hands-on learning? Do you have expertise in emerging threats, defensive strategies, or cutting-edge security techniques? We want to hear from you!
Visit training.defcon.org to submit your application by January 12, 2026.
https://training.defcon.org/pages/2026-las-vegas-call-for-trainers#DEFCON #DEFCONTraining #Cybersecurity #Training #Hacking #InfoSec #SecurityCommunity #DEFCON2026 #DEFCON34 #DC34 #AI #RedTeam #BlueTeam #DigitalForensics #CyberTalent #MalwareAnalysis
-
🐽 Snort Command Cheat Sheet: Understand Network Threats Like a Pro
Snort is a powerful open-source tool used for Network Intrusion Detection and Prevention (NIDS/NIPS). It's widely adopted by blue teams and security professionals to monitor, alert, and defend against malicious network activity.
🧠 Key Usage Modes (No Code Needed):
• Test Mode: Check configuration files before deployment
• Packet Sniffing Mode: Monitor live traffic and display it in real time
• Packet Logging Mode: Capture packets and store them for analysis
• IDS Mode: Analyze traffic against rule sets and raise alerts
• Silent Mode: Run in the background while logging events🛡️ Snort is great for:
• Detecting port scans and suspicious payloads
• Monitoring traffic for policy violations
• Integrating with SIEM solutions
• Practicing blue team defensive strategiesDisclaimer: This content is intended strictly for educational and awareness purposes. Use intrusion detection systems responsibly and ethically.
#Snort #NetworkSecurity #CyberSecurity #InfoSec #BlueTeam #IDS #EducationOnly #IntrusionDetection #SOCTools #PacketAnalysis
-
There is something so satisfying in kicking off an entire RFC1918 scan.
Doing a single port at a brisk but safe (for my environment) pace.
~/# nmap -Pn -n -p <single port number> -T4 --open 10.0.0.0/8
~/# nmap -Pn -n -p <single port number> -T4 --open 172.16.0.0/12
~/# nmap -Pn -n -p <single port number> -T4 --open 192.168.0.0/16
(command broken out for dramatic effect - also note that I break out each of those CIDRs into /24's so that if anything breaks, I can pick up easier where the last known good ended. It's scripted and I prefer it this way.)
I am not doing a ping sweep or a DNS resolution. I'm assuming all hosts are up. And I'm looking for every host with a single port open. So even if they dont respond to pings (or something is preventing pings), I should get an answer back.
Note, I could certainly do faster (T5 or masscan, gawd) - but this is about as fast as I'm going to do in my environment and still be safe.
Also, only looking for open ports right now - no fingerprinting yet.
A cool thing about this approach is many intrusion detection still will only look for multiple ports on a single host to trigger an alert. Some still ignore many hosts / single port scans (to their detriment).
We've long sense purple teamed this, so I sent a notification to SOC letting them know my actions and asking them nicely (I bribed them last week) to not stop me, lol.
Should take a couple weeks to a month at this pace and in my environment to hit every single one of the just shy of 18,000,000 hosts 😂
#pentesting #hacking #infosec #penetrationtesting #blueteam #redteam #intrusionDetection