Application Security
Detecting and Mitigating System Process Persistence (T1543)
Attackers install or edit services, daemons and agents to run at boot. A defender's guide to T1543 across Windows, Linux, macOS and containers.
Oct 18, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting and Mitigating TFTP Boot Abuse (T1542.005)
TFTP boot lets a network device load its OS image from a server. Here is how attackers abuse it for persistence, and how to detect and prevent it.
Oct 18, 20263 min read
Application Security
Detecting ROMMONkit Tampering on Cisco Devices (T1542.004)
A tampered ROMMON image gives persistent control of a network device. What MITRE documents, signals to watch and how secure boot and image checks help.
Oct 18, 20262 min read
Application Security
Detecting Bootkits (T1542.003)
Bootkits run before the OS by changing the MBR, VBR or EFI system partition. How they work per MITRE, what to monitor and how secure boot and TPM help.
Oct 18, 20264 min read
Application Security
Detecting Component Firmware Tampering (T1542.002)
Disks, network cards and other parts carry their own firmware, often with less checking. What MITRE says and what to do about it.
Oct 18, 20262 min read
Application Security
Detecting System Firmware Tampering (T1542.001)
BIOS and UEFI modifications survive reinstalls and hide from the OS. What MITRE says, which signals matter and how hardware root of trust helps.
Oct 18, 20262 min read
Application Security
Detecting Pre-OS Boot Persistence (T1542)
Malware that runs before the operating system escapes host defenses. How firmware and boot persistence works, what to monitor and how secure boot and TPM help.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating Web Session Cookie Theft (T1539)
A stolen session cookie can bypass passwords and some MFA. How cookies get taken, what detection looks like and the controls that make a stolen cookie far less useful.
Oct 18, 20265 min read
Application Security
Detecting Cloud Service Dashboard Use (T1538)
With stolen credentials an attacker can browse a cloud console and learn your environment without any API calls. What to watch and how to limit what a console shows.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.