29
https://www.reddit.com/r/blueteamsec/ Thanks to @reddit2telegram and @r_channels
How to OTel: A blueprint for OpenTelemetry adoption
https://www.elastic.co/blog/opentelemetry-overview-blueprint-otel-architecture
https://redd.it/1r56cnx
@r_blueteamsec
BSOD_bitlocker_recover: Python script for carving Bitlocker VMK keys
https://github.com/fishermavis/BSOD_bitlocker_recover
https://redd.it/1r5732n
@r_blueteamsec
Hunting Queriesqne Detection Rules for Defender for Office365 using Teams MDO Advanced Hunting tables
https://github.com/HybridBrothers/Hunting-Queries-Detection-Rules/tree/main/Defender%20for%20Office365
https://redd.it/1r59i8n
@r_blueteamsec
How Coinbase Safeguards PII Using MPC Encryption
https://www.coinbase.com/en-gb/blog/consumer-protection-tuesday-how-coinbase-safeguards-pii-using-mpc-encryption
https://redd.it/1r57tav
@r_blueteamsec
Get-EntraUserMFAConfig.ps1: PowerShell script to identify Entra ID Tier 0 member MFA settings
https://github.com/PyroTek3/EntraID/blob/main/Get-EntraUserMFAConfig.ps1
https://redd.it/1r4htjo
@r_blueteamsec
US needs to impose ‘real costs’ on bad actors, State Department cyber official says
https://therecord.media/usa-cyber-actors-consequences
https://redd.it/1r4hmes
@r_blueteamsec
Cyber Threat Intelligence Framework
https://www.cert.europa.eu/publications/threat-intelligence/cyber-threat-intelligence-framework/
https://redd.it/1r4oclq
@r_blueteamsec
CTO at NCSC Summary: week ending February 15th
https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-february-550
https://redd.it/1r4gshh
@r_blueteamsec
Largest Multi-Agency Cyber Operation Mounted to Counter Threat Posed by Advanced Persistent Threat (APT) Actor UNC3886 to Singapore’s Telecommunications Sector
https://www.csa.gov.sg/news-events/press-releases/largest-multi-agency-cyber-operation-mounted-to-counter-threat-posed-by-advanced-persistent-threat--apt--actor-unc3886-to-singapore-s-telecommunications-sector/
https://redd.it/1r0d8zv
@r_blueteamsec
DKIM replay attacks: Apple and PayPal invoice abuse - summary: ability to set a variable to inject a scam message into a DKIM signed message for later reuse
https://www.kaseya.com/blog/dkim-replay-attacks-apple-paypal-invoice-abuse/
https://redd.it/1qzvnqw
@r_blueteamsec
Malicious Bing Ads Lead to Widespread Azure Tech Support Scams
https://www.netskope.com/blog/malicious-bing-ads-lead-to-widespread-azure-tech-support-scams
https://redd.it/1qzvo7y
@r_blueteamsec
FOSDEM 2026 - A Modern Look at Secure Boot
https://fosdem.org/2026/schedule/event/XVLRTK-a_modern_look_at_secure_boot/
https://redd.it/1qzf0kj
@r_blueteamsec
Defense Evasion: The Service Run Failed Successfully
https://www.zerosalarium.com/2026/02/Defense-Evasion-The-service-run-failed-successfully.html?m=1
https://redd.it/1qzgt2i
@r_blueteamsec
PhantomFS: Serving payloads only to allowed processes using Windows projected file system feature
https://github.com/S1lkys/PhantomFS
https://redd.it/1qzguhy
@r_blueteamsec
Approaching cyclone: Vortex Werewolf attacks Russia
https://bi-zone.medium.com/approaching-cyclone-vortex-werewolf-attacks-russia-c6d1147ab627
https://redd.it/1qzdfrd
@r_blueteamsec
CIC-Trap4Phish: A Unified Multi-Format Dataset for Phishing and Quishing Attachment Detection
https://arxiv.org/abs/2602.09015
https://redd.it/1r57bn6
@r_blueteamsec
Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools
https://matheuzsecurity.github.io/hacking/ebpf-security-tools-hacking/
https://redd.it/1r56gts
@r_blueteamsec
Jailbreaking Leaves a Trace: Understanding and Detecting Jailbreak Attacks from Internal Representations of Large Language Models
https://arxiv.org/abs/2602.11495
https://redd.it/1r57d7l
@r_blueteamsec
JoySafeter is not just a productivity tool, but an "operating system" for security capabilities. It unifies fragmented security tools into a collaborative AI army through visual intelligent orchestration, and precipitates individual expert experience into organizational digital assets.
https://github.com/jd-opensource/JoySafeter
https://redd.it/1r577la
@r_blueteamsec
Attackers Weaponize Signed RMM Tools via Zoom, Meet, & Teams Lures
https://www.netskope.com/blog/attackers-weaponize-signed-rmm-tools-via-zoom-meet-teams-lures
https://redd.it/1r4hutv
@r_blueteamsec
Mapping shadow AI agents in enterprise environments — techniques and tooling
We've been working on improving our visibility into AI/LLM deployments across our environment and wanted to share some observations and hear what others are doing.
The challenge: development teams are integrating LLM agents and AI automation at a pace that outstrips security's ability to track them. We found AI agents embedded in n8n workflows, LangChain deployments, Zapier integrations, and custom Python scripts — many with access to production data and credentials.
What we found works for discovery:
- Network traffic analysis for outgoing calls to known LLM API endpoints (api.openai.com, api.anthropic.com, etc.)
- Scanning IaC and CI/CD configs for AI SDK imports and API key references
- SBOM-style enumeration of AI components — treating models, agents, and data flows as inventory items
- Monitoring credential vaults for AI-service-related secrets that were provisioned outside normal change management
The harder problem is classification — once you find these agents, determining which ones are processing PII, making autonomous decisions, or operating without human oversight.
For anyone interested in the SBOM approach for AI components, there's an open-source scanner called ai-bom (github.com/Trusera/ai-bom) that automates the discovery step across common platforms.
What detection methods are other blue teams using for shadow AI? Anyone built custom SIEM rules for LLM API traffic?
https://redd.it/1r4yfdt
@r_blueteamsec
Securing Entra ID Administration: Tier 0
https://trustedsec.com/blog/securing-entra-id-administration-tier-0
https://redd.it/1r4hsnw
@r_blueteamsec
Augustus: Open-source LLM vulnerability scanner with 210+ adversarial probes (Go, Apache 2.0)
https://github.com/praetorian-inc/augustus
https://redd.it/1r0hgtq
@r_blueteamsec
Zscaler / MacOS 26.2 issues
If anyone is running Zscaler on MacOS, it is worth checking when your clients last connected. There is a known conflict with ZIA and MacOS 26.2 that prevents Zscaler from logging in unless you have the updated client. However the Zscaler client won't automatically update if it can't log in. So if any macs were updated to 26.2 before the new ZIA client was released, they will now be logged out and will need the ZIA client updating via another means. It also fails open, so the users may not notice.
https://redd.it/1r06838
@r_blueteamsec
SQLi in administrative interface - SQLi in administrative interface - FortiClientEMS 7.4
https://www.fortiguard.com/psirt/FG-IR-25-1142
https://redd.it/1qzvqme
@r_blueteamsec
Simple Ransomware Detection with a Windows Minifilter (Sanctum EDR)
https://fluxsec.red/simple-ransomware-detection-sanctum-minifilter
https://redd.it/1qzeqt6
@r_blueteamsec
wardgate: Give AI agents API access without giving them your credentials. Reduce the blast radius!
https://github.com/wardgate/wardgate
https://redd.it/1qzh63q
@r_blueteamsec
Breaking Down CVE-2026-25049: How TypeScript Types Failed n8n's Security
https://hetmehta.com/posts/n8n-type-confusion-rce
https://redd.it/1qzgyhf
@r_blueteamsec
Acknowledging Reality in Vulnerability Disclosure
https://www.foo.be/2026/02/Acknowledging-Reality-in-Vulnerability-Disclosure
https://redd.it/1qzflm8
@r_blueteamsec
Commission responds to cyber-attack on its central mobile infrastructure
https://ec.europa.eu/commission/presscorner/detail/en/ip_26_342
https://redd.it/1qzbjmb
@r_blueteamsec