Blue Team

Ben Bowman, Blue Team, Blue Team Tools, External/Internal, Web App Cyber Deception, Deceptive Tooling, Go-Spoof

Go-Spoof: A Tool for Cyber Deception

Go-Spoof brings an old tool to a new language. The Golang rewrite [of Portspoof] provides similar efficiency and all the same features of the previous tool but with easier setup and useability.

Read the entire post here

Blue Team, Blue Team Tools, How-To, Informational, Jack Hyland, Web App cross-site scripting, xsscanary

Canary in the Code: Alert()-ing on XSS Exploits

I’ve been a web application pentester for a while now and over the years must have found hundreds of cross-site scripting (XSS) vulnerabilities.1 Cross-site scripting is a notoriously difficult problem […]

Read the entire post here

Blue Team, Incident Response, John Strand, Red Team, Webcast Wrap-Up AI, cloud, penetration testing

5 Things We Are Going to Continue to Ignore in 2025

In this video, John Strand discusses the complexities and challenges of penetration testing, emphasizing that it goes beyond just finding and exploiting vulnerabilities.

Read the entire post here

Hunt Teaming, Informational, InfoSec 101 Beginner, On the Hunt, PROMPT#, Q&A, threat hunting

Questions From a Beginner Threat Hunter

Answered by Chris Brenton of Active Countermeasures | Questions compiled from the infosec community by Shelby Perry This article was originally published in the Threat Hunting issue of our infosec […]

Read the entire post here

Blue Team, Blue Team Tools, How-To, Informational, InfoSec 201, Jordan Drysdale

One Active Directory Account Can Be Your Best Early Warning

Here we go again, discussing Active Directory, hacking, and detection engineering. tl;dr: One AD account can provide you with three detections that if implemented properly will catch common adversarial activities […]

Read the entire post here

Blue Team, Hayden Covington, Informational, InfoSec 101 Security Operations Center, SOC

Clear, Concise, and Comprehensive: The Formula for Great SOC Tickets

A lot of emphasis and focus is put on the investigative part of SOC work, with the documentation and less glamorous side of things brushed under the rug. One such […]

Read the entire post here

Blue Team, Blue Team Tools, Guest Author, Informational, InfoSec 101, Red Team, Red Team Tools Infosec for Beginners, InfoSec Survival Guide, Purple Team

Blue Team, Red Team, and Purple Team: An Overview

By Erik Goldoff, Ray Van Hoose, and Max Boehner || Guest Authors This post is comprised of 3 articles that were originally published in the second edition of the InfoSec […]

Read the entire post here

Blue Team, Incident Response, Informational, Jordan Drysdale Blue Team Detections, detection engineering, event auditing, msDS-KeyCredentialLink, Shadow creds

Enable Auditing of Changes to msDS-KeyCredentialLink 

Changes to the msds-KeyCredentialLink attribute are not audited/logged with standard audit configurations. This required serious investigations and a partner firm in infosec provided us the answer: TrustedSec.  So, credit where […]

Read the entire post here

Blue Team, David Perez, Incident Response, Informational Azure, Entra ID, SIEM, SOC

Monitoring High Risk Azure Logins 

Recently in the SOC, we were notified by a partner that they had a potential business email compromise, or BEC. We commonly catch these by identifying suspicious email forwarding rules, […]

Read the entire post here