Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
VBA stomping swaps macro source for harmless text while leaving compiled code to run. What MITRE documents, why source scanners miss it, and how to limit VBA.
A VM on a compromised host can hide tools and traffic from security software. What MITRE documents for Hyper-V, Windows Sandbox and ESXi, and how to audit your VMs.
Some adversaries keep their own file system outside the one the OS shows. What MITRE documents, the platform signals, and where to look for odd mounts.
Alternate Data Streams and extended attributes can hide data inside files that look normal. What MITRE documents and the read-only commands that reveal streams.
Hidden windows keep malicious activity off the screen. What MITRE documents for PowerShell, plist keys and hidden desktops, and how to find hidden execution from command lines.
Accounts can be kept off the login screen with a registry value, a plist key or a display manager setting. What MITRE documents and how to list accounts that do not show.
A leading dot or a hidden flag keeps a file out of sight. What MITRE documents across Windows, Linux and macOS, and the read-only commands that show what is really there.
Attackers hide files, users, windows and even whole virtual machines. A tour of MITRE Hide Artifacts, how to detect it, and the audit habits that bring hidden things back into view.
With SYSTEM rights, an attacker can take over a Windows remote desktop session without a password or prompt. MITRE details RDP Hijacking, the signals, and the policy fixes.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
