Application Security
Detecting and Mitigating WMI Event Subscriptions (T1546.003)
WMI event filters, consumers and bindings can run code on a clock or logon, as SYSTEM. See how to list subscriptions and which logs to collect.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting and Mitigating Screensaver Persistence (T1546.002)
A screensaver is just a PE file that runs after inactivity. See how four registry values enable persistence on Windows and how to shut the door.
Oct 18, 20262 min read
Application Security
Detecting Default File Association Hijacking (T1546.001)
Changing the handler for a file type makes Windows run attacker code whenever that file opens. Here is how it works and how to detect it.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Event Triggered Execution (T1546)
Attackers hook into logons, file opens, signals and cloud events to run code again and again. A cross platform guide to T1546 and its 18 sub-techniques.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating Container Service Abuse (T1543.005)
Restart policies and Kubernetes DaemonSets can keep a malicious container alive on every node. See how it works, what to watch and how to harden.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating Launch Daemon Abuse (T1543.004)
Launch Daemons run as root before anyone logs in on macOS. See how adversaries abuse them for persistence and what to watch and lock down.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Malicious Windows Services (T1543.003)
New or edited Windows services give SYSTEM level persistence, and can load drivers. See what to log, how to harden, and how to audit services.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating Malicious Systemd Services (T1543.002)
Systemd unit files can run code at every boot as any user. See how .service files, symlinks and generators are abused, and how to audit them.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating Launch Agent Abuse on macOS (T1543.001)
Launch Agents run at login from plist files. Learn how adversaries abuse them on macOS, what to log, and how to review your own agent folders.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.