Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Attackers who change data rather than steal it attack trust in your numbers. MITRE T1565 explained, with detection ideas and four mitigations in plain steps.
Extended attributes can carry a second stage that does not change a file hash. What MITRE documents for T1564.014, how to inspect xattrs, and how to scan them.
A bind mount over a process /proc entry can make ps and top show a benign process instead. What MITRE documents for T1564.013 and how to detect it.
Antivirus exclusions are blind spots by design. What MITRE documents for T1564.012, how to audit yours, and which writes to watch.
Commands that shrug off hangup signals let malware outlive a logout or a dropped connection. What MITRE documents for T1564.011 and how to spot it.
How adversaries rewrite command-line arguments in process memory after logging, and the signals defenders can use to catch the mismatch. MITRE ATT&CK T1564.010.
Resource forks can carry hidden code on macOS. Here is what MITRE documents about T1564.009, how to spot it with extended attributes, and what developers can do.
Inbox and transport rules can quietly delete or bury security alerts. What MITRE documents for T1564.008, how to audit rules, and what to check in Exchange.
VBA stomping swaps macro source for harmless text while leaving compiled code to run. What MITRE documents, why source scanners miss it, and how to limit VBA.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
