Application Security
Detecting and Mitigating Time Provider Abuse (T1547.003)
Windows Time service providers are DLLs loaded at boot. See how a new registry subkey becomes persistence and how Group Policy can block it.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting and Mitigating Authentication Package Abuse (T1547.002)
LSA authentication packages load as DLLs at boot. See how that autostart is abused and how running LSA as a protected process helps.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Registry Run Keys and Startup Folders (T1547.001)
Run keys and the Startup folder launch programs at logon. See the default keys, the less obvious ones and how to audit and alert on them.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating Boot or Logon Autostart (T1547)
Run keys, startup folders, systemd units and launch plists all start programs for you. A defender's guide to T1547 across Windows, Linux and macOS.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating Python Startup Hooks (T1546.018)
Python .pth files and sitecustomize modules run code at every interpreter start. See how they are abused and how to audit site-packages.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating Udev Rules Abuse on Linux (T1546.017)
Udev rules run commands when hardware events occur. Learn how RUN+= is abused for Linux persistence and which directories to monitor.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Installer Package Abuse (T1546.016)
Installer scripts run with elevated rights on Linux, macOS and Windows. See how modified packages abuse that and how to vet packages before install.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating COM Hijacking (T1546.015)
Hijacked COM registry references run attacker code in place of trusted components. See how it works, including TypeLib variants, and how to detect it.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Emond Abuse on macOS (T1546.014)
The macOS Event Monitor Daemon runs rule files as root on events like startup and login. Learn how it is abused and how to disable it.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.