Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Lines added to .bashrc, .profile or .zshrc run at every login or new terminal. See how it works on Linux and macOS and how to audit your own files.
WMI event filters, consumers and bindings can run code on a clock or logon, as SYSTEM. See how to list subscriptions and which logs to collect.
A screensaver is just a PE file that runs after inactivity. See how four registry values enable persistence on Windows and how to shut the door.
Changing the handler for a file type makes Windows run attacker code whenever that file opens. Here is how it works and how to detect it.
Attackers hook into logons, file opens, signals and cloud events to run code again and again. A cross platform guide to T1546 and its 18 sub-techniques.
Restart policies and Kubernetes DaemonSets can keep a malicious container alive on every node. See how it works, what to watch and how to harden.
Launch Daemons run as root before anyone logs in on macOS. See how adversaries abuse them for persistence and what to watch and lock down.
New or edited Windows services give SYSTEM level persistence, and can load drivers. See what to log, how to harden, and how to audit services.
Systemd unit files can run code at every boot as any user. See how .service files, symlinks and generators are abused, and how to audit them.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
