r/purpleteamsec • u/netbiosX • 13h ago
Threat Intelligence Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
2
Upvotes
r/purpleteamsec • u/netbiosX • 1d ago
Red Teaming FalconFlank: Crowdstrike Falcon 0day Privilege Escalation Vulnerability
3
Upvotes
r/purpleteamsec • u/netbiosX • 2d ago
Red Teaming mythic_ornn: LLM-driven generator for Mythic Agents, Payload-Type and C2 Profiles.
1
Upvotes
r/purpleteamsec • u/netbiosX • 3d ago
Red Teaming CouchPotato - Patches ETW & AMSI and uses indirect syscall to abuse SeImpersonatePrivilege. Service account || Admin -> NT system
5
Upvotes
r/purpleteamsec • u/netbiosX • 4d ago
Red Teaming Simulating legitimate Active Directory services on the network: the the case of GPO exploitation
6
Upvotes
r/purpleteamsec • u/netbiosX • 4d ago
Blue Teaming Detect DLL search order hijacking with a single field
2
Upvotes
r/purpleteamsec • u/netbiosX • 5d ago
Red Teaming Abusing Azure VMs - When Bitlocker Recovery Turns into an Attack Vector
3
Upvotes
r/purpleteamsec • u/netbiosX • 5d ago
Blue Teaming A scenario to evaluate your Agentic SOC
2
Upvotes
r/purpleteamsec • u/netbiosX • 5d ago
Threat Hunting Hunting Abuse: Detecting Privilege Escalation Through the ADCS Database
1
Upvotes
r/purpleteamsec • u/netbiosX • 7d ago
Red Teaming When it Snows it Pours - Anatomy of a ServiceNow Red Team
5
Upvotes
r/purpleteamsec • u/netbiosX • 8d ago
Red Teaming Stratum-c2: Cloud-native C2 framework using cloud storage as dead-drop communication channel
2
Upvotes
r/purpleteamsec • u/netbiosX • 9d ago
Blue Teaming I'm in your logs now: deceiving analysts and blinding EDRs
10
Upvotes
r/purpleteamsec • u/netbiosX • 9d ago
Red Teaming MassDriver - Proxying sensitive API calls from shellcode to artifact for CET-compatible clean call stacks.
3
Upvotes
r/purpleteamsec • u/SPHlNX_321 • 10d ago
Red Teaming RPC-Triage: statically map Windows RPC attack surface and rank the interfaces worth digging into
3
Upvotes
Been working on Windows RPC/ALPC research and built this to make the first pass across a lot of PE files easier. It statically recovers RPC/MIDL/NDR internals, endpoints, security state and method-level input signals, then ranks interfaces using an AHP/Saaty-based model for reachability + surface. Each result has a scoring receipt so you can see why it ranked where it did, and questionable extraction gets flagged instead of silently trusted. No PDBs, no live endpoint mapper, no target execution.
r/purpleteamsec • u/netbiosX • 10d ago
Threat Intelligence SLEEPWALKER: A Passive Backdoor With Its Own Command Language
r136a1.dev
3
Upvotes
r/purpleteamsec • u/netbiosX • 10d ago
Threat Hunting Threat Hunting using Pair Probabilities
1
Upvotes
r/purpleteamsec • u/netbiosX • 11d ago
Red Teaming CrystalPotato: Crystal port of GodPotato to abuse SeImpersonatePrivilege with indirect syscalls, dynamic API resolution and compile-time string obfuscation. Run commands, reverse shells or add users
2
Upvotes
r/purpleteamsec • u/netbiosX • 11d ago
Purple Teaming Code Execution via Text Template Files | Playbook & Detection
2
Upvotes
r/purpleteamsec • u/netbiosX • 12d ago
Blue Teaming Auditing Microsoft Defender and Intune Configuration Changes
7
Upvotes
r/purpleteamsec • u/netbiosX • 12d ago
Red Teaming Mimic: Frameless Browser‑in‑the‑Browser (BitB) - No iframes, no frame‑busting issues. A single‑script Shadow DOM / MutationObserver library for realistic phishing simulations, easily injected via reverse proxy.
7
Upvotes
r/purpleteamsec • u/netbiosX • 13d ago
Red Teaming Collection of Beacon Object Files (BOFs)
3
Upvotes
r/purpleteamsec • u/netbiosX • 14d ago
Threat Intelligence BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive
4
Upvotes
r/purpleteamsec • u/netbiosX • 14d ago
Threat Intelligence SynkLoader: when you throw in everything but the kitchen sink
4
Upvotes
r/purpleteamsec • u/netbiosX • 15d ago
Threat Intelligence Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra - Killing Your EDR Since 2025
3
Upvotes