Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
MITRE ATT&CK T1091: malware that spreads or gets in through USB drives and phones, even into air-gapped networks. Detection ideas, ASR rules and Autorun settings.
MITRE ATT&CK T1090.004: HTTPS traffic that names one domain in TLS and another in HTTP. How it hides C2 behind CDNs and how TLS inspection exposes it.
MITRE ATT&CK T1090.003: attackers chaining relays, Tor and ORB networks to hide where traffic comes from. Detection signals and the limits of blocklists.
MITRE ATT&CK T1090.002: attackers hiding their C2 server behind outside relays such as VPS hosts. What outbound signals to watch and what MITRE advises.
MITRE ATT&CK T1090.001: attackers relaying C2 traffic through compromised internal hosts. See the host and network signals that expose peer to peer relays.
MITRE ATT&CK T1090 explained: how attackers relay command and control traffic through proxies, which signals expose it, and what network controls help.
MITRE ATT&CK T1087.004: attackers listing IAM users, roles and directory accounts with cloud CLIs and APIs. Detection ideas and least privilege steps.
MITRE ATT&CK T1087.003: attackers dumping global address lists from Exchange or Google Workspace. Where to look for bulk directory queries.
MITRE ATT&CK T1087.002: attackers enumerating Active Directory users and groups to find privileged targets. Detection signals and one hardening setting.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
