Application Security
Detecting and Mitigating InstallUtil Abuse (T1218.004)
InstallUtil runs installer components inside .NET binaries, and attackers can use it to dodge application control. MITRE T1218.004 for defenders.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting and Mitigating CMSTP Abuse (T1218.003)
CMSTP.exe installs connection profiles from INF files and can be abused to load remote code and bypass UAC. MITRE T1218.003 for defenders.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating Control Panel Item Abuse (T1218.002)
Control Panel .cpl files are renamed DLLs that control.exe and rundll32.exe will run. MITRE T1218.002 detection and mitigation for defenders.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating Compiled HTML File Abuse (T1218.001)
CHM help files can carry scripts and run through hh.exe. MITRE T1218.001 explained, with detection signals and mitigations for defenders.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating System Binary Proxy Execution (T1218)
Signed, trusted binaries can run attacker content for them. MITRE T1218 explained, with a detection approach, mitigations and a rollout plan.
Oct 18, 20266 min read
Application Security
Detecting Browser Information Discovery (T1217)
Bookmarks, history and saved logins reveal internal systems and credentials. MITRE T1217 and how to spot processes reading browser data.
Oct 18, 20264 min read
Application Security
Detecting SyncAppvPublishingServer Script Abuse (T1216.002)
A signed App-V script can be used to run PowerShell without calling powershell.exe directly. How MITRE T1216.002 works and how to catch and block it.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating PubPrn Proxy Execution (T1216.001)
PubPrn.vbs is a signed Microsoft script that can be abused to run remote scriptlets. What T1216.001 documents, how to spot it and how to block it.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating System Script Proxy Execution (T1216)
Signed Microsoft scripts can proxy the execution of other files and slip past application control. What T1216 says and how to respond.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.