Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
New cloud users, service principals and roles can hand an attacker durable access. What to watch in IAM, identity provider and SaaS audit logs, and how to limit it.
A rogue domain account works on every joined machine. See what MITRE says to watch on domain controllers and how to limit who can create accounts.
From net user on Windows to esxcli on ESXi and kubectl on clusters, new local accounts are a quiet way to keep access. Commands, events and fixes.
A new account outlives the malware that created it. How MITRE says attackers add local, domain and cloud accounts, and which audit events catch it.
Attackers list shared folders to decide what to steal and where to move next. How share enumeration looks in logs on Windows, Linux and macOS, and what to change.
SID-History was built for domain migrations, and attackers can stuff it with admin SIDs. How to detect changes and clear out stale values in Active Directory.
Forging a process's parent hides Office-spawns-PowerShell chains and can borrow SYSTEM rights. See the mismatches that expose it across three Windows log sources.
With a stolen password but no logged-on user, an attacker can create a fresh logon session. Here are the Windows events and logon types that give it away.
Spawning a new process under another user's token is a quiet way up the privilege ladder. Here is the log pattern MITRE describes and the rights worth limiting.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
