Application Security
Detecting and Mitigating Mavinject Abuse (T1218.013)
Mavinject.exe is the App-V injector, and it can inject DLLs into running processes. MITRE T1218.013 and what defenders should do about it.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting and Mitigating Verclsid Abuse (T1218.012)
Verclsid.exe verifies shell extensions, and it can be pointed at COM objects. MITRE T1218.012 detection and mitigation in plain steps.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Rundll32 Abuse (T1218.011)
Rundll32 runs DLL functions, CPL files and even scripts. MITRE T1218.011 explained, with detection signals, tuning advice and mitigations.
Oct 18, 20265 min read
Application Security
Detecting and Mitigating Regsvr32 Abuse (T1218.010)
Regsvr32 can fetch and run COM scriptlets from a URL without registering anything. MITRE T1218.010 and the Squiblydoo variant for defenders.
Oct 18, 20265 min read
Application Security
Detecting and Mitigating Regsvcs and Regasm Abuse (T1218.009)
Regsvcs and Regasm register .NET COM assemblies and can run code even when they fail. MITRE T1218.009 explained for defenders.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Odbcconf Abuse (T1218.008)
Odbcconf.exe configures ODBC drivers, and its REGSVR flag can load DLLs. MITRE T1218.008 explains the abuse, the detection chain and the fixes.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Msiexec Abuse (T1218.007)
Msiexec.exe can launch local or remote MSI files and DLLs, and AlwaysInstallElevated raises it to SYSTEM. MITRE T1218.007 for defenders.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating Mshta Abuse (T1218.005)
Mshta.exe runs HTML Applications outside the browser, which helps attackers sidestep controls. MITRE T1218.005 detection and mitigation guide.
Oct 18, 20265 min read
Application Security
Detecting and Mitigating InstallUtil Abuse (T1218.004)
InstallUtil runs installer components inside .NET binaries, and attackers can use it to dodge application control. MITRE T1218.004 for defenders.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.