Contagious InterviewG1052 ↗
Has configured C2 endpoints to review IP geolocation, request headers, victim environment details and runtime conditions prior to delivering payloads.1
tfMITRE ATT&CK technique
Execution Guardrails T1480
- Tactic
- Stealth
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 2.0
- Created
- 31 January 2019
- Last modified
- 12 May 2026
- Contributor
- Nick Carr, Mandiant
Sub-techniques 21 rules across the family · 1 mapped directly to T1480 · 0 of 2 carry rules
Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.[1] Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.[2]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.45
Tools & malwareTop 9%
Tools & malware91st percentile · 91% of ATT&CK techniques have this many tools implementing them or fewer.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Execution Guardrails MITRE reference T1480
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
BlackByteG1043 ↗
Stopped execution if identified language settings on victim machines was Russian or one of several language associated with former Soviet republics.1 BlackByte has used ransomware variants requiring a key passed on the command line for the malware to execute.2
APT-C-36G0099 ↗
Has used geolocation filtering in malware delivery to redirect traffic not coming from a targeted region or country, such as Ecuador or Colombia, to legitimate sites.12
Gamaredon GroupG0047 ↗
Has used geoblocking to limit downloads of the malicious file to specific geographic locations.12
All 4 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
RedDelta Modified PlugX Infection Chain OperationsC0047 ↗
Mustang Panda included the use of Cloudflare geofencing mechanisms to limit payload download activity during RedDelta Modified PlugX Infection Chain Operations.1
All 1 campaigns for this technique
45 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Mini Shai-HuludS9043 ↗
Has utilized execution guardrails in order to prevent operating in restricted geolocations to include Russia by checking the devices language and terminating when a forbidden value is detected.12 Mini Shai-Hulud has also utilized designated instructions that execute when victim hosts match geolocations to include wiping victim devices when the device is determined to be located within Iran or Israel.3
CanisterWormS9042 ↗
Can base execution on specific conditions including halting its wiper component if Kubernetes is not found and if the target is not located in Iran.1
TeamPCP Cloud StealerS9041 ↗
Has checked if it is running on a developer machine (rather than GitHub Actions) before executing a Python script for persistence. The script has also polled C2 every 50 minutes for additional payloads and aborted if the returned value contained YouTube.12
LazyWiperS9039 ↗
Can halt execution if [System.Net.Dns]::GetHostName() or $env:COMPUTERNAME contains “pe-dc”.1
Tsundere BotnetS9034 ↗
Has checked the victim machine’s location to avoid infecting in the Commonwealth of Independent States (CIS) region.1
ROAMINGHOUSES9026 ↗
Can change its execution method to create a batch file in the startup folder that executes a legitimate executable if a McAfee product is detected.1
All 45 software entries for this technique · 6 newest in this preview
Offense vs defense T1480
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1
first rule: 2022 Q1 · 1 of 1 campaigns plottedExecution Guardrails detection strategy DET0562
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Multi-Platform Execution Guardrails Environmental Validation Detection Strategy
4 platforms
AN1551 · Windows
Windows environmental validation behavioral chain: (1) Rapid system discovery reconnaissance through WMI queries, registry enumeration, and network share discovery, (2) Environment-specific artifact collection (hostname, domain, IP addresses, installed software, hardware identifiers), (3) Cryptographic operations or conditional logic based on collected environmental values, (4) Selective payload execution contingent on environmental validation results, (5) Temporal correlation between discovery activities and subsequent execution or network communication
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | WinEventLog:Security | EventCode=4648 |
| WMI CreationDC0008 | WinEventLog:WMI | EventCode=5857, 5858, 5860, 5861 |
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process ModificationDC0020 | WinEventLog:Sysmon | EventCode=8 |
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DiscoveryTimeWindow | Maximum time window for correlating multiple discovery activities indicating reconnaissance phase - adjust based on normal system behavior (default: 300 seconds) |
| DiscoveryActivityThreshold | Minimum number of different discovery techniques within time window to trigger detection - balance between false positives and coverage (default: 4 activities) |
| CryptographicLibraryWhitelist | Approved cryptographic libraries and modules for legitimate organizational use - maintain based on approved software inventory |
| WMIQueryComplexityThreshold | Complexity score for WMI queries indicating reconnaissance vs. legitimate administration - tune based on administrative patterns |
| EnvironmentalArtifactList | Environment-specific values commonly targeted by guardrails (hostnames, domains, network shares) - customize for organizational environment |
| ExecutionDelayBaseline | Statistical baseline for normal delay between discovery and execution activities - establish through historical analysis |
AN1552 · Linux
Linux environmental validation behavioral chain: (1) Intensive system enumeration through command execution (uname, hostname, ifconfig, lsblk, mount), (2) File system reconnaissance targeting specific paths, network configurations, and installed packages, (3) Process and user enumeration to validate target environment characteristics, (4) Conditional script execution or binary activation based on environmental criteria, (5) Network connectivity validation and external IP address resolution for geolocation verification
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | linux:syslog | authentication and authorization events during environmental validation phase |
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File AccessDC0055 | auditd:SYSCALL | open |
| Command ExecutionDC0064 | auditd:PROCTITLE | command-line execution patterns for system discovery utilities (uname, hostname, ifconfig, netstat, lsof, ps, mount) |
| Network Connection CreationDC0082 | auditd:SYSCALL | openat,connect -k discovery |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SystemDiscoveryCommandList | Linux commands commonly used for system reconnaissance - customize based on environment-specific discovery patterns |
| ReconnaissanceBurstThreshold | Number of discovery commands within time window indicating reconnaissance burst - tune based on legitimate administrative activity |
| EnvironmentalCheckPatterns | File paths and system properties commonly validated by environmental keying - adapt to organizational infrastructure |
| NetworkDiscoveryBaseline | Normal network discovery activity patterns to distinguish from malicious reconnaissance |
| ConditionalExecutionIndicators | Script patterns and conditional logic indicating environment-based execution decisions |
AN1553 · macOS
macOS environmental validation behavioral chain: (1) System profiling through system_profiler, sysctl, and hardware discovery commands, (2) Network interface and configuration enumeration for geolocation and network environment validation, (3) Application installation and version discovery for software environment fingerprinting, (4) Security feature detection (SIP, Gatekeeper, XProtect status), (5) Conditional payload execution based on macOS-specific environmental criteria and System Integrity Protection bypass validation
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | process execution events for system discovery utilities (system_profiler, sysctl, networksetup, ioreg) with parameter analysis |
| File AccessDC0055 | fs:fileevents | File system access events with kFSEventStreamEventFlagItemRemoved, kFSEventStreamEventFlagItemRenamed flags for environmental artifact collection (/System/Library, /usr/sbin, plist files) |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MacOSDiscoveryTools | macOS-specific system discovery utilities commonly used for environmental validation |
| SecurityFeatureEnumeration | Security features and configurations typically validated by macOS execution guardrails |
| HardwareFingerprintBaseline | Normal hardware discovery patterns to distinguish from environmental validation attempts |
| SIPBypassIndicators | Patterns indicating attempts to validate or bypass System Integrity Protection |
AN1554 · ESXi
ESXi hypervisor environmental validation behavioral chain: (1) Virtual machine inventory and configuration enumeration through vim-cmd and esxcli commands, (2) Host hardware and network configuration discovery for hypervisor environment validation, (3) Datastore and storage configuration reconnaissance, (4) vCenter connectivity and cluster membership validation, (5) Selective malware deployment based on virtualization infrastructure characteristics and target VM validation
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | esxi:hostd | host daemon events related to VM operations and configuration queries during reconnaissance |
| Command ExecutionDC0064 | esxi:shell | shell command execution for system discovery (vim-cmd, esxcli, vmware-cmd) targeting VM inventory and host configuration |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ESXiDiscoveryCommands | ESXi commands commonly used for hypervisor and VM reconnaissance |
| VMInventoryEnumerationThreshold | Number of VM inventory queries within time window indicating reconnaissance activity |
| HypervisorEnvironmentBaseline | Normal hypervisor management activity patterns for distinguishing malicious reconnaissance |
| DatastoreAccessPatterns | Unusual datastore access patterns indicating environmental validation or target selection |
Do Not MitigateM1055
Execution Guardrails likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised. If targeted, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised.