Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
The at utility schedules one-off jobs on Windows, Linux and macOS. See how MITRE says it is abused, what to log, and how at.allow and at.deny limit it.
Scheduled tasks give attackers startup execution, persistence and a way to borrow a trusted process. A cross-platform guide to detection and hardening.
How data leaves a network on a USB drive, what to log when a device is mounted, and the policy controls MITRE lists to restrict removable media.
Data can leave on a USB drive, especially from air-gapped networks. See what to monitor on endpoints and how to restrict removable media.
Attackers list network connections to learn who talks to whom. See the commands MITRE names, how to catch them in logs, and why this one is best used as context.
Stolen data can leave in plain FTP, HTTP, SMTP or DNS, sometimes hidden in headers or subdomains. Learn the signals and the controls that cut it off.
Data can leave over HTTPS, SFTP or SMTPS, all encrypted and all common. See detection ideas that work without reading the traffic, and the network controls that help.
Attackers can encrypt stolen data with a shared key and send it over a protocol that is not their C2 channel. See what to detect and which network controls help.
Data can leave over FTP, SMTP, DNS, SMB or a cloud API instead of the C2 channel. See what to log and which egress controls shrink the options.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
