Airbus CERT

Analyzing the unsafe chroot behavior of sudo CVE-2025-32463 | Sky Blueteam A story of a bee, a sandwich and a crab

🐝 New blog post at skyblue.team/posts/unsafe...

At Airbus CERT, we worked on the sudo CVE-2025-32463 to create detection and hunting rules.
Based on the underlying vulnerability, we developed an eBPF based tool to monitor unsafe chroot behavior regarding NSS reloading.

github.com/airbus-cert/...

04.11.2025 15:30 — 👍 1    🔁 1    💬 0    📌 0

GitHub - airbus-cert/minusone: Powershell Linter Powershell Linter. Contribute to airbus-cert/minusone development by creating an account on GitHub.

New release of minusone (v0.4.0) with a lot of new deobfuscation pattern : github.com/airbus-cert/...
🚨Online version : minusone.skyblue.team 🚨
#powershell #deobfuscation

30.07.2025 07:12 — 👍 2    🔁 1    💬 0    📌 0

Ever dreamt of parsing the $I3O INDX files from a 80GB drive in under 10 seconds? ⏱️

Dream no more ✨ Courtesy of @eeriedusk.bsky.social and #RustLang 🦀🦀🦀

#DFIR #Forensics

25.06.2025 12:09 — 👍 2    🔁 0    💬 0    📌 0