Application Security
Detecting and Mitigating PowerShell Profile Abuse (T1546.013)
A PowerShell profile script runs whenever PowerShell starts. Learn how it becomes persistence, which files to watch and how to reduce exposure.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting and Mitigating IFEO Injection (T1546.012)
Image File Execution Options can launch a debugger of an attacker's choosing, or silently disable security tools. See how to audit the keys.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating Application Shimming Abuse (T1546.011)
Windows compatibility shims can inject DLLs and bypass UAC. See how shim databases get abused for persistence and how to inspect them.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating AppInit DLLs Abuse (T1546.010)
AppInit_DLLs loads a library into nearly every Windows program that uses user32.dll. See how it is abused and how Secure Boot helps.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating AppCert DLLs Abuse (T1546.009)
DLLs in the AppCertDLLs registry key load into every process that calls CreateProcess. Here is how it is abused and how to catch it.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Accessibility Features Abuse (T1546.008)
Replacing sethc.exe or utilman.exe gives a SYSTEM shell at the Windows logon screen. See how it works and how to harden RDP and application control.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating Netsh Helper DLL Abuse (T1546.007)
A registered netsh helper DLL runs whenever netsh.exe does. See how the registry key is abused for persistence and what to monitor.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating LC_LOAD_DYLIB Addition (T1546.006)
Editing a Mach-O header makes a macOS binary load a malicious dylib every time it runs. See how it works and how to baseline and sign.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Trap Command Abuse (T1546.005)
The shell trap command runs code when a signal arrives. Learn how it becomes persistence on Linux and macOS and how to spot it in startup files.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.