Application Security
Detecting and Mitigating Input Capture (T1056)
Input capture covers keyloggers, fake prompts, rigged login pages and API hooks. Here is how the family works and where defenders should look.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting and Mitigating ListPlanting Injection (T1055.015)
ListPlanting abuses Windows list-view controls to run code in another process using window messages. What MITRE documents and how to spot it.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating VDSO Hijacking on Linux (T1055.014)
VDSO hijacking redirects syscall stubs inside a running Linux process to load a malicious shared object. Here is how MITRE describes it and what to watch for.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Process Doppelgänging (T1055.013)
Process doppelgänging abuses Transactional NTFS to run code from a file image that never lands on disk. What MITRE documents and what to do about it.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating Process Hollowing (T1055.012)
Process hollowing starts a legitimate Windows process suspended, replaces its memory, and resumes it. What MITRE documents and how to detect and reduce it.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating Extra Window Memory Injection (T1055.011)
Extra Window Memory injection abuses a small per-window storage area in Windows GUI processes to run code while skipping heavily monitored APIs.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Proc Memory Injection on Linux (T1055.009)
Proc memory injection uses the /proc filesystem to find and overwrite another Linux process's memory. How MITRE describes it and how to defend against it.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating Ptrace Process Injection on Linux (T1055.008)
Ptrace lets one Linux process control another, and adversaries can abuse it to inject code. Detection ideas, Yama ptrace_scope and other mitigations from MITRE.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating TLS Callback Injection (T1055.005)
TLS callback injection redirects a Windows process to attacker code before its real entry point runs. What MITRE documents, and what to monitor.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.