Application Security
Detecting Time Based Sandbox Evasion (T1497.003)
Sleep timers and clock checks help malware outlast or detect sandboxes. What MITRE documents and which delay patterns are worth alerting on.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting User Activity Checks in Malware (T1497.002)
Some malware waits for a real person before it acts. What MITRE documents about mouse, history and click checks, and how to make analysis harder to fool.
Oct 18, 20262 min read
Application Security
Detecting System Checks Used for Sandbox Evasion (T1497.001)
Malware inspects CPU, memory, drivers and names to decide whether it is in a virtual machine. What MITRE documents and what to log.
Oct 18, 20263 min read
Application Security
Detecting Virtualization and Sandbox Evasion (T1497)
Malware that checks whether it is being analyzed can hide its real behavior. What MITRE documents, what the checks look like, and how defenders can respond.
Oct 18, 20264 min read
Application Security
Detecting Cloud Service Hijacking and LLMjacking (T1496.004)
Stolen keys can turn email, SMS and AI services into free infrastructure for attackers, with you paying the bill. What MITRE documents and how to detect and limit it.
Oct 18, 20262 min read
Application Security
Detecting and Preventing SMS Pumping Fraud (T1496.003)
SMS pumping turns your OTP and sign up forms into a revenue source for fraudsters. What MITRE documents, how to detect it, and the form level fixes.
Oct 18, 20262 min read
Application Security
Detecting Bandwidth Hijacking and Proxyjacking (T1496.002)
Attackers can use your network bandwidth for botnets, torrents, scanning or proxyjacking. What MITRE documents and what egress signals to watch.
Oct 18, 20262 min read
Application Security
Detecting Compute Hijacking and Cryptomining (T1496.001)
Cryptominers target servers, cloud instances and containers. What MITRE documents, what behavior to alert on, and how to check images and dependencies before deploy.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating Resource Hijacking (T1496)
Cryptomining, proxyjacking, SMS pumping and cloud service abuse all burn your resources for someone else. What MITRE documents and what usage signals to watch.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.