Application Security
Detecting Windows File Permission Changes (T1222.001)
icacls, takeown, attrib and PowerShell ACL cmdlets can grant an intruder access to protected files. MITRE T1222.001 detection and hardening steps.
Oct 18, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting File and Directory Permissions Modification (T1222)
Attackers change permissions and ownership to reach files they should not touch. MITRE T1222 across Windows, Linux, macOS and ESXi, with detection steps.
Oct 18, 20265 min read
Application Security
Detecting and Mitigating Template Injection (T1221)
A document can point to a remote template that loads the real payload later. MITRE T1221 explained with detection signals and mitigations.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating XSL Script Processing (T1220)
XSL stylesheets can carry embedded script. MITRE T1220 covers msxsl.exe and the Squiblytwo variant, plus how to detect and block them.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Remote Access Hardware (T1219.003)
IP based KVM devices such as TinyPilot and PiKVM can give an intruder hands on keyboard control. MITRE T1219.003 and how to spot and block them.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Remote Desktop Software Abuse (T1219.002)
TeamViewer, AnyDesk, ScreenConnect and similar tools are often allowed by policy, which is why attackers use them. MITRE T1219.002 for defenders.
Oct 18, 20265 min read
Application Security
Detecting and Mitigating IDE Tunneling Abuse (T1219.001)
Remote development features in IDEs can double as a command channel on developer machines. MITRE T1219.001 detection and mitigation for defenders.
Oct 18, 20265 min read
Application Security
Detecting and Mitigating Remote Access Tool Abuse (T1219)
Legitimate remote support and management software can become an attacker's command channel. MITRE T1219 with detection chains and mitigations.
Oct 18, 20265 min read
Application Security
Detecting and Mitigating Electron Application Abuse (T1218.015)
Slack, Teams and many other desktop apps run on Electron, and that can be abused to run code under a trusted name. MITRE T1218.015 for defenders.
Oct 18, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.