Application Security
Detecting Malicious Power Settings Changes (T1653)
Attackers change sleep, lock and reboot behavior to keep infected machines running. What MITRE documents and how to audit power settings on endpoints.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Understanding Device Driver Discovery (T1652)
Listing drivers tells an attacker about security tools and exploitable software. The utilities MITRE names, what to log, and why prevention is limited.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Cloud Administration Command Abuse (T1651)
AWS Systems Manager, Azure Run Command and similar services can run scripts inside VMs. How attackers use them, what to correlate in logs, and who should hold the permission.
Oct 18, 20263 min read
Application Security
Understanding Acquire Access and Initial Access Brokers (T1650)
Some intruders buy their way in. What MITRE says about purchased access, why you cannot see the sale, and which basics shrink what a broker has to sell.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Stolen or Forged Auth Certificates (T1649)
Certificates can act as credentials. How adversaries steal or forge them through AD CS and device certificates, what to monitor, and how to harden your certificate authority.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating Serverless Execution Abuse (T1648)
Lambda functions, Power Automate flows and Apps Script can run attacker code that outlives a stolen session. What MITRE documents, which events to watch, and which permissions to remove.
Oct 18, 20264 min read
Application Security
Detecting Malicious Plist File Modification on macOS (T1647)
Plist files tell macOS how to run apps. Attackers edit them to hide apps or add persistence. What to monitor and the hardened runtime guidance MITRE lists.
Oct 18, 20262 min read
Application Security
Understanding Debugger Evasion in Malware (T1622)
Malware that detects a debugger changes behavior to frustrate analysis. The checks MITRE lists on Windows and Linux, and what it means for analysts and sandbox teams.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating MFA Fatigue Attacks (T1621)
Repeated push prompts wear users down until one gets approved. How MITRE describes MFA request generation, what to watch in sign-in logs, and how to make push approvals harder to abuse.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.