Application Security
Modify Cloud Compute Configurations (T1578.005) Guide
MITRE T1578.005: quota, region and tenant policy changes let attackers use more compute quietly. Signals to watch and permissions to tighten.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Revert Cloud Instance (T1578.004) Detection Basics
MITRE T1578.004: restoring snapshots or resetting ephemeral storage can erase evidence in the cloud. What to monitor and why logs must live elsewhere.
Oct 18, 20262 min read
Application Security
Delete Cloud Instance (T1578.003): Evidence Destruction
MITRE T1578.003: deleting a cloud VM removes forensic evidence. Signals to alert on and logging steps that preserve what you need.
Oct 18, 20262 min read
Application Security
Create Cloud Instance (T1578.002): Spot Rogue VMs
MITRE T1578.002: new VMs in a victim account can sidestep firewall rules and permissions. Learn the signals and least privilege controls to apply.
Oct 18, 20263 min read
Application Security
Create Snapshot (T1578.001): Cloud Defense Evasion
MITRE T1578.001: a snapshot gives an attacker a copy of a VM or volume outside the original controls. Detection chains and least privilege fixes.
Oct 18, 20263 min read
Application Security
Modify Cloud Compute Infrastructure (T1578): Detect and Limit
MITRE T1578: adversaries create, delete or change cloud instances and snapshots to evade defenses. See the detection chains and IAM controls that matter.
Oct 18, 20264 min read
Application Security
AppDomainManager Injection (T1574.014) Defender Guide
MITRE T1574.014: .NET AppDomainManager injection loads a malicious assembly into a trusted process. Signals to watch and how to restrict write access.
Oct 18, 20262 min read
Application Security
KernelCallbackTable Hijacking (T1574.013) for Defenders
MITRE T1574.013: replacing a callback in a process KernelCallbackTable hijacks execution inside a trusted process. Detection and mitigation notes.
Oct 18, 20262 min read
Application Security
COR_PROFILER Hijacking (T1574.012) Detection Guide
MITRE T1574.012: the .NET COR_PROFILER setting can load an unapproved DLL into every .NET process. See what to watch and how to restrict it.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.