Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
DCSync abuses the domain replication API to pull password data from Active Directory. See the permissions to lock down and the events worth watching.
Cached domain credentials let users log on when a domain controller is down. See how MITRE describes theft on Windows and Linux, plus detection and fixes.
LSA secrets can hold service account credentials in the registry and memory. Learn the MITRE description, the signals to monitor and the mitigations.
The NTDS database holds every Active Directory credential. Learn how MITRE describes its theft, what to monitor on domain controllers, and how to harden backups.
The Security Account Manager stores local account hashes on Windows. See how MITRE describes its theft, what to log, and which mitigations cut the risk.
LSASS holds credential material after logon, which makes it a prime target. Learn what to log, which mitigations MITRE lists, and how to check your settings.
OS credential dumping pulls hashes and passwords from memory, caches and files. See the sub-techniques, what to log, and the mitigations MITRE lists.
Adversaries make C2 traffic look like TLS, web or cloud service traffic. Review the MITRE description and the metadata signals that expose the fake.
Steganography hides C2 messages inside images or documents. See how MITRE describes it and how file plus network signals help defenders catch it.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
