Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Adding an account to Administrators, Remote Desktop Users, VPN or sudo groups is a quiet way to keep access. See how to detect group changes on Windows, Linux and macOS.
Attackers with enough access bind extra roles to accounts to keep control of a cluster. Here is how RoleBinding abuse works and how to spot and limit it.
How attackers enroll their own devices in MFA and device management systems to persist, and how to catch and block it in Entra ID, Intune, Okta and Duo.
MITRE ATT&CK T1098.004: attackers adding their own public keys to authorized_keys for persistent SSH access on Linux, macOS, ESXi, cloud VMs and network devices.
MITRE ATT&CK T1098.003: attackers granting themselves cloud roles and IAM policies for persistence. Signals to monitor and least privilege steps.
MITRE ATT&CK T1098.002: attackers adding mailbox delegates and folder permissions to keep access to email. Detection and hardening steps for Exchange and Google Workspace.
MITRE ATT&CK T1098.001: attackers adding keys, passwords and certificates to cloud accounts to keep access. Audit signals and the mitigations MITRE recommends.
MITRE ATT&CK T1098: attackers changing credentials, groups and roles to keep or raise access. Cross-platform detection signals and the controls MITRE lists.
MITRE ATT&CK T1095: command and control over ICMP, UDP, SOCKS and ESXi VMCI. See why these channels slip past monitoring and how to find them.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
