Application Security
Detecting Deobfuscate and Decode Files or Information (T1140)
Hidden payloads must be decoded before they run. How certutil, copy /b, base64 and friends show up in logs, and how to catch the decoding step.
Oct 18, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting and Mitigating Malicious Office Add-ins (T1137.006)
WLL, XLL, COM, VSTO and VBA add-ins all run code at Office startup. How to spot a malicious one and how to restrict add-ins to signed, approved ones.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Malicious Outlook Rules (T1137.005)
Outlook rules sort mail, but a hostile one can launch a program when a crafted email arrives. How to audit rules, what logs show, and how to block it.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating the Outlook Home Page Abuse (T1137.004)
Outlook can load a web page whenever a folder opens, and a crafted page can run code. How the legacy feature is abused and how to spot and block it.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Malicious Outlook Forms (T1137.003)
A custom Outlook form planted in a mailbox can run code when a crafted email arrives. What it looks like, which patches matter and how to spot it.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating the Office Test Registry Key (T1137.002)
A little-known Office Test registry key loads any DLL when Word or Excel starts. It does not exist by default, so its presence is a strong signal.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Office Template Macros (T1137.001)
A macro hidden in Normal.dotm or PERSONAL.XLSB runs every time Word or Excel starts. Where those files live, how GlobalDotName is abused, and how to block it.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating Office Application Startup Persistence (T1137)
Templates, add-ins, Outlook rules, forms and home pages can all run code when Office starts. A guide to the six methods, what to log and which settings to harden.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating Cloud Account Creation (T1136.003)
New cloud users, service principals and roles can hand an attacker durable access. What to watch in IAM, identity provider and SaaS audit logs, and how to limit it.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.