Application Security
Detecting and Mitigating APC Injection (T1055.004)
APC injection queues attacker code on a thread in a running Windows process. How it works at a high level, and how to detect and reduce it.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting and Mitigating Thread Execution Hijacking (T1055.003)
Thread execution hijacking suspends a thread in a live Windows process, swaps in attacker code, and resumes it. Detection and mitigation guidance from MITRE.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating PE Injection (T1055.002)
PE injection copies code into another process and runs it there. Learn the API sequence MITRE says to watch for and the endpoint controls that help.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating DLL Injection (T1055.001)
DLL injection runs code inside another Windows process. See how MITRE describes the variants, the API chain to watch for, and the endpoint mitigation.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating Process Injection (T1055)
Process injection runs code inside another live process to evade defenses. A cross-platform guide to the behavior, the telemetry to collect and the controls that help.
Oct 18, 20265 min read
Application Security
Detecting and Mitigating Malicious Kubernetes CronJobs (T1053.007)
Container orchestration jobs can schedule malicious containers across a cluster. Here is what MITRE says to watch for and how to limit who can create them.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Systemd Timer Abuse (T1053.006)
Systemd timers are a cron alternative on Linux that can also serve as persistence. Learn what MITRE says to log and which permissions to lock down.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Windows Scheduled Task Abuse (T1053.005)
Windows Task Scheduler is used for persistence, remote execution and even hidden tasks. Learn what to log, how hiding works, and which settings reduce exposure.
Oct 18, 20265 min read
Application Security
Detecting and Mitigating Cron Job Abuse (T1053.003)
Cron is the default scheduler on Linux, macOS and ESXi, and a common persistence spot. See what MITRE says to monitor and how cron.allow and cron.deny help.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.