Application Security
Exfiltration Over Bluetooth (T1011.001) Defense Guide
Bluetooth can carry stolen data outside your network monitoring. See what MITRE documents, how to detect it on each OS and how to switch it off.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Exfiltration Over Other Network Medium (T1011) Guide
Data can leave through WiFi, Bluetooth or cellular instead of the main network link. See what MITRE says and how to disable what you do not need.
Oct 18, 20262 min read
Application Security
Application Window Discovery (T1010) Detection Basics
Listing open application windows tells adversaries how a system is used and what security tools run. See what MITRE says and how to spot the API and script use.
Oct 18, 20262 min read
Application Security
Fallback C2 Channels (T1008) Detection and Mitigation Guide
Adversaries keep a backup command channel in case the main one is blocked. Learn the signals MITRE lists and how to find a host that switches paths.
Oct 18, 20266 min read
Application Security
System Service Discovery (T1007) Detection Guide
Adversaries list services and scheduled tasks to shape what they do next. See the commands MITRE names and how to spot them in process logs.
Oct 18, 20264 min read
Application Security
Direct Volume Access on Windows (T1006) Detection and Defense
Direct volume access reads files by bypassing file permissions and monitoring. See what MITRE documents and how to watch backup tools and raw drive access.
Oct 18, 20264 min read
Application Security
Detecting Data Collection From the Local System (T1005)
Before exfiltration, adversaries search local files, configs, databases and memory. See what MITRE documents, the signals to log and how to limit the loot.
Oct 18, 20265 min read
Application Security
Protecting /etc/passwd and /etc/shadow From Dumping (T1003.008)
Linux password hashes live in /etc/shadow. Learn how adversaries dump the file for offline cracking and how to detect and prevent it.
Oct 18, 20264 min read
Application Security
Credential Dumping From the Linux /proc Filesystem (T1003.007)
The Linux proc filesystem exposes process memory maps. See how MITRE says it is abused for credentials and how to detect and limit that access.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.