Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A desktop file in an XDG autostart folder runs a command each time the desktop loads. MITRE T1547.013 explained, with directories to watch and a package ownership check.
Print processors are DLLs the Windows print spooler loads at boot, which makes them a SYSTEM level persistence spot. MITRE T1547.012 explained, with detection and mitigation.
A port monitor DLL loaded by the print spooler runs as SYSTEM at boot. MITRE T1547.010 explained, with the registry path and spoolsv.exe signals worth monitoring.
Shortcuts in the startup folder can launch malware at login, and an edited target path can hijack a trusted shortcut. MITRE T1547.009 explained, with detection and permissions advice.
Replacing or adding LSASS drivers gives code a recurring run inside the Windows security subsystem. MITRE T1547.008 explained, with LSA Protection and Credential Guard as defenses.
macOS can reopen apps at login from a plist file, and attackers can add their own entry. MITRE T1547.007 explained, with detection ideas and how to turn the feature off.
Loadable kernel modules and macOS kexts run at the highest privilege, which makes them rootkit territory. MITRE T1547.006 explained, with detection, hardening and read-only checks.
Security Support Provider DLLs load into the LSA process at boot and can see stored passwords. Learn what MITRE T1547.005 documents, what to monitor, and how LSA protection helps.
Winlogon registry keys decide what runs at logon, so a changed Shell, Userinit or Notify value is persistence. MITRE T1547.004 explained, with a read-only check and detection signals.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
