Application Security
Windows Logon Scripts via the Registry (T1037.001)
HKCU Environment UserInitMprLogonScript runs a program at every logon. Learn how it is abused, which events to watch, and how to protect the key.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Boot or Logon Initialization Scripts (T1037): Detection
Scripts that run at boot or logon give attackers quiet persistence. Learn what to watch on Windows, Linux, macOS, ESXi and network devices, and how to lock the files down.
Oct 18, 20264 min read
Application Security
Spoofed Browser Fingerprints (T1036.012): Detection Notes
Malware can copy a browser's user agent to blend in with normal traffic. See how to spot HTTP clients that claim to be a browser but are not.
Oct 18, 20262 min read
Application Security
Overwriting Process Arguments (T1036.011) on Linux
Malware can overwrite its own argv in memory so ps shows a harmless name. Learn how the trick works and how to compare cmdline with the real executable.
Oct 18, 20263 min read
Application Security
Masquerading Account Names (T1036.010): Detect and Audit
Attackers create accounts named admin, help or backup to blend in. Learn what to log across cloud, identity and endpoint systems and how to audit accounts.
Oct 18, 20264 min read
Application Security
Breaking Process Trees (T1036.009) on Linux and macOS
Double forking or daemonizing cuts a process from its parent so tree-based detection loses the thread. See how it works and how to look for orphaned processes.
Oct 18, 20263 min read
Application Security
Masquerading File Types (T1036.008): Detection Guide
Malware renamed as an image, or given a fake header, can slip past file checks. Learn how it works and how to validate content, not just extensions.
Oct 18, 20263 min read
Application Security
Double File Extensions (T1036.007): Spot and Stop Them
Evil.txt.exe can display as Evil.txt. Here is how double extensions work on Windows, how to detect them, and the one setting that removes most of the trick.
Oct 18, 20263 min read
Application Security
Space After Filename (T1036.006) on macOS and Linux
A trailing space can change how macOS and Linux open a file and hide its true type. See how the trick works and how to find affected files.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.