Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Command history files keep what users typed, including passwords passed as arguments. MITRE T1552.003 explained, with file locations, detection signals and history settings.
Applications sometimes save passwords in the Registry, and attackers search for them. MITRE T1552.002 explained, with the detection signal and the fix that matters most.
Passwords in config files, scripts, shares and container logs are easy pickings. MITRE T1552.001 explained, with detection by platform, mitigation steps and read-only checks.
Passwords in files, history, the Registry, keys and metadata services are all fair game. MITRE T1552 explained, with detection by platform, mitigations and a checklist to run yourself.
A stolen session cookie can skip MFA because the session is already authenticated. MITRE T1550.004 explained for cloud and SaaS defenders, with detection ideas and a cookie hygiene step.
Pass the ticket reuses stolen Kerberos tickets to move laterally. MITRE T1550.003 explained, with event IDs 4768, 4769 and 4624 correlation and the KRBTGT reset guidance.
Pass the hash uses a stolen password hash to log in without the password. MITRE T1550.002 explained, with the NTLM logon signals to watch and the credential overlap fixes.
A stolen OAuth or cloud access token works without a password or second factor. MITRE T1550.001 explained, with cloud and SaaS detection signals and token binding advice.
Hashes, Kerberos tickets, tokens and cookies let an attacker act as a user without a password. MITRE T1550 explained, with the common detection pattern and mitigations for each.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
