Application Security
Asymmetric Cryptography in C2 (T1573.002) for Defenders
MITRE T1573.002 covers C2 hidden with RSA-style public key crypto, including TLS. Here are the signals and mitigations to know.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Symmetric Cryptography in C2 (T1573.001) for Defenders
MITRE T1573.001 covers C2 hidden with AES, RC4 and similar ciphers. See the detection signals and mitigations in plain terms.
Oct 18, 20262 min read
Application Security
Encrypted Channel (T1573): Spotting Hidden C2 Traffic
Adversaries encrypt command and control traffic on their own terms. Learn what MITRE T1573 says about detection, TLS inspection and baselines.
Oct 18, 20263 min read
Application Security
Protocol Tunneling (T1572): Detection and Mitigation Guide
Tunneling hides one protocol inside another to dodge filters and reach blocked systems. See what MITRE T1572 documents and how defenders can spot and limit it.
Oct 18, 20264 min read
Application Security
Detecting Non-Standard Port Use for C2 (T1571)
Adversaries pair protocols with unexpected ports to slip past filters. Here is how MITRE T1571 works, what to log, and how to tighten egress.
Oct 18, 20264 min read
Application Security
Lateral Tool Transfer: Spotting File Movement Inside (T1570)
How attackers copy tools between internal systems over SMB, RDP, scp and sync folders, which logs reveal it, and how to restrict it. MITRE ATT&CK T1570.
Oct 18, 20265 min read
Application Security
Systemctl Abuse on Linux: What to Watch (T1569.003)
Attackers can run code as systemd services with systemctl. What MITRE documents for T1569.003, how to review units and who should have access.
Oct 18, 20262 min read
Application Security
Service Execution on Windows: Detecting It (T1569.002)
How the Windows service control manager, sc.exe and PsExec are used to run code, which events to log, and the three mitigations MITRE lists for T1569.002.
Oct 18, 20264 min read
Application Security
Launchctl Abuse on macOS: Detection Basics (T1569.001)
launchctl runs Launch Agents and Daemons, which makes it a natural way to execute code on macOS. What MITRE documents for T1569.001 and what to review.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.