Application Security
Detecting and Mitigating Clear Command History (T1070.003)
Attackers wipe bash, PowerShell, ESXi and network device command history. Learn where each history lives and how to preserve it.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting and Mitigating Indicator Removal (T1070)
Intruders delete or edit logs, histories and file metadata to hide their tracks. See what MITRE documents, how to detect tampering, and why remote logging is the core fix.
Oct 18, 20265 min read
Application Security
Detecting and Mitigating Cloud Groups Discovery (T1069.003)
Cloud group and role enumeration shows which accounts are worth stealing. See the Azure, Google and AWS calls MITRE names and how to log them.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Domain Groups Discovery (T1069.002)
Domain group enumeration shows an intruder who the domain admins are. See the commands MITRE lists and the signals that make this activity stand out.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Local Groups Discovery (T1069.001)
Listing local groups shows an intruder who has admin rights on a host. See the commands MITRE names and how to detect them across Windows, Linux and macOS.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Permission Groups Discovery (T1069)
Attackers list groups to find who holds elevated rights. Learn what MITRE documents for this Discovery technique and how to spot it in your logs.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Exploitation for Privilege Escalation (T1068)
How software flaws let low-privilege code become SYSTEM or root, escape a container, or load a vulnerable driver, and what patching and isolation do about it.
Oct 18, 20266 min read
Application Security
Detecting and Mitigating Container CLI and API Abuse (T1059.013)
Docker and Kubernetes expose powerful CLIs and APIs. See how MITRE describes their abuse for execution, what to log, and how RBAC and rootless containers help.
Oct 18, 20264 min read
Application Security
Detecting and Mitigating Hypervisor CLI Abuse (T1059.012)
On ESXi, esxcli and vim-cmd can reconfigure firewalls, list VMs and stop them. Here is what MITRE documents and what to watch for.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.