MITRE ATT&CKtechnique

T1480 Execution Guardrails

Published 2019-01-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
ESXi, Linux, macOS, Windows
Version
2.0
Created
2019-01-31

Description

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign. Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses. Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical Virtualization/Sandbox Evasion. While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match. Adversaries may identify and block certain user-agents to evade defenses and narrow the scope of their attack to victims and platforms on which it will be most effective. A user-agent self-identifies data such as a user's software application, operating system, vendor, and version. Adversaries may check user-agents for operating system identification and then only serve malware for the exploitable software while ignoring all other operating systems.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1055 Do Not Mitigate mitigation

Referenced by MITRE ATT&CK · subtechnique of (2)

Referenced by MITRE ATT&CK · uses (52)

  • S9050 Vidar software (malware)
  • S9043 Mini Shai-Hulud software (malware)
  • S9042 CanisterWorm software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • S9039 LazyWiper software (malware)
  • S9034 Tsundere Botnet software (malware)
  • S9020 LODEINFO software (malware)
  • S9023 HiddenFace software (malware)
  • S9026 ROAMINGHOUSE software (malware)
  • S9019 PureCrypter software (malware)
  • S9010 GlassWorm software (malware)
  • S9003 evilginx2 software (tool)
  • S9001 SystemBC software (malware)
  • G1052 Contagious Interview group
  • S1242 Qilin software (malware)
  • S1240 RedLine Stealer software (malware)
  • S1239 TONESHELL software (malware)
  • S1212 RansomHub software (malware)
  • S1210 Sagerunex software (malware)
  • S1202 LockBit 3.0 software (malware)
  • S1200 StealBit software (malware)
  • S1199 LockBit 2.0 software (malware)
  • C0047 RedDelta Modified PlugX Infection Chain Operations campaign
  • S1194 Akira _v2 software (malware)
  • S1185 LightSpy software (malware)
  • S1183 StrelaStealer software (malware)
  • S1184 BOLDMOVE software (malware)
  • S1179 Exbyte software (malware)
  • S1180 BlackByte Ransomware software (malware)
  • G1043 BlackByte group
Show all 52 ›

References