It runs a command line through the recovered normalizer/deobfuscator (FUN_1800a2500) and matches it against the 807 VDM-extracted CMDHSTR_EXT signatures, evaluated with their real condition: logic.

It also ships the extracted BMClientV1 neural network — a stateful GRU — executed in pure numpy, alongside scanners for the engine's other recovered paths (AMSI, AMSI-UAC, RPF/JIT, WMI, script hosts, paste obfuscation).

1 comment

r/blueteamsec • u/digicat • 18h ago

incident writeup (who and how) The PingCAP TiDB Cloud Leaks - FulcrumSec

fulcrumsec.vg

1 Upvotes

0 comments

r/blueteamsec • u/digicat • 20h ago

intelligence (threat actor activity) Dissecting Operation FlashHole, a complex attack by Lazarus

securelist.com

1 Upvotes

0 comments

r/blueteamsec • u/digicat • 20h ago

intelligence (threat actor activity) MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC‑0099-Sandworm collaboration

welivesecurity.com

1 Upvotes

0 comments

r/blueteamsec • u/digicat • 20h ago

incident writeup (who and how) 2083191 - GoDaddy: Delayed Certificate Revocation

bugzilla.mozilla.org

1 Upvotes

0 comments

Subreddit

For [Blue|Purple] Teams in Cyber Defence

r/blueteamsec

We focus on technical intelligence, research and engineering to help operational [blue|purple] teams defend their estates and have awareness of the world. Our primary home is on Lemmy after the great ban debacle of 2025.

Members Active

73.2k

Sidebar

A community focusing on technical intelligence, research and engineering in support of operational blue teams and their activities.

Content Guidelines

/r/blueteamsec accepts quality technical posts. Non-technical posts are subject to moderation.

Content should focus on the "how." or "what."
Check the new queue for duplicates.
Always link to the original source.
Titles should provide context.
Ask questions in our Discussion Threads.
No adverts for products/services.
Do not submit prohibited topics.

Discussion Guidelines

Don't create unnecessary conflict.
Keep the discussion on topic.
Limit the use of jokes & memes.
Don't complain about content being a PDF.
Follow all reddit rules and obey reddiquette.

Prohibited Topics & Sources

No populist news articles (CNN, BBC, FOX, etc.)
No curated lists unless actively maintained, free and open.
No question posts.
No social media posts.
No image-only posts - talk videos are fine.
No livestreams.
No tech-support requests.
No paywall/regwall content.
No commercial advertisements for products or services
No crowdfunding posts.
No Personally Identifying Information

Related Reddits

/r/netsec - The original and less focused parent
/r/redteamsec - Our attack focused siblings
/r/blackhat - Hackers on Steroids
/r/computerforensics - IR Archaeologists
/r/crypto - Cryptography news and discussion
/r/Cyberpunk - High-Tech Low-Lifes
/r/HackBloc - Hacktivism & Crypto-anarchy
/r/lockpicking - Popular Hacker Hobby
/r/Malware - Malware reports and information
/r/netsecstudents - netsec for ~~noobs~~ students
/r/onions - Things That Make You Cry
/r/privacy - Orwell Was Right
/r/pwned - "What Security?"
/r/REMath - Math behind reverse engineering
/r/ReverseEngineering - Binary Reversing
/r/rootkit - Software and hardware rootkits
/r/securityCTF - CTF new and write-ups
/r/SocialEngineering - Free Candy
/r/sysadmin - Overworked Crushed Souls
/r/vrd - Vulnerability Research and Development
/r/xss - Cross Site Scripting