Application Security
Detecting Windows Host Firewall Tampering (T1686.003)
Attackers use netsh, PowerShell and the registry to turn off or reshape Windows Firewall. Learn the signals, the event IDs and the checks to run today.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting Network Device Firewall Changes (T1686.002)
Perimeter firewalls and routers are targets for rule tampering. See what T1686.002 documents, what to monitor on appliances, and which controls matter.
Oct 18, 20263 min read
Application Security
Detecting Cloud Firewall Tampering (T1686.001)
Attackers with cloud permissions can add ingress rules or new security groups. Learn what T1686.001 covers and which control plane logs to watch.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Firewall Tampering (T1686)
Attackers turn off firewalls or add rules that open covert paths. Here is how T1686 works across Windows, Linux, macOS, ESXi and network gear, and how to catch it.
Oct 18, 20265 min read
Application Security
Impair Autonomous Defenses: Prompt Tricks in Malware (T1685.007)
Malware can carry text meant to make an LLM analysis tool give up. MITRE T1685.007 explains the idea and how to keep AI-assisted analysis from being steered by what it examines.
Oct 18, 20263 min read
Application Security
Detecting Cleared Linux or macOS System Logs (MITRE ATT&CK T1685.006)
Attackers delete or truncate files in /var/log to hide an intrusion. See which logs they go after, what to alert on, and how off-host forwarding protects you.
Oct 18, 20264 min read
Application Security
Detecting Cleared Windows Event Logs (MITRE ATT&CK T1685.005)
Wiping the Security log is a classic cleanup step. Learn the commands MITRE documents, the events that record it, and why central log forwarding is the real fix.
Oct 18, 20264 min read
Application Security
Detecting Disabled or Modified Linux Audit System (T1685.004)
With root, an adversary can stop auditd or edit its rules to hide activity. See what MITRE documents, how auditctl -e 2 helps, and which read-only checks to run.
Oct 18, 20264 min read
Application Security
Detecting Modified or Spoofed Security Tool UI (MITRE ATT&CK T1685.003)
A green icon is not proof of protection. Learn how adversaries fake security tool status and how to compare the display with the real service state.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.