Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Attackers change permissions and ownership to reach files they should not touch. MITRE T1222 across Windows, Linux, macOS and ESXi, with detection steps.
A document can point to a remote template that loads the real payload later. MITRE T1221 explained with detection signals and mitigations.
XSL stylesheets can carry embedded script. MITRE T1220 covers msxsl.exe and the Squiblytwo variant, plus how to detect and block them.
IP based KVM devices such as TinyPilot and PiKVM can give an intruder hands on keyboard control. MITRE T1219.003 and how to spot and block them.
TeamViewer, AnyDesk, ScreenConnect and similar tools are often allowed by policy, which is why attackers use them. MITRE T1219.002 for defenders.
Remote development features in IDEs can double as a command channel on developer machines. MITRE T1219.001 detection and mitigation for defenders.
Legitimate remote support and management software can become an attacker's command channel. MITRE T1219 with detection chains and mitigations.
Slack, Teams and many other desktop apps run on Electron, and that can be abused to run code under a trusted name. MITRE T1218.015 for defenders.
Microsoft Management Console can open custom .msc files and activate COM objects. MITRE T1218.014 detection and mitigation for defenders.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
