Contagious InterviewG1052 ↗
Has configured C2 endpoints to review IP geolocation, request headers, victim environment details and runtime conditions prior to delivering payloads.1
tfMITRE ATT&CK technique
Execution Guardrails T1480
- Tactic
- Stealth
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 2.0
- Created
- 31 January 2019
- Last modified
- 12 May 2026
- Contributor
- Nick Carr, Mandiant
Sub-techniques 21 rules across the family · 1 mapped directly to T1480 · 0 of 2 carry rules
Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.[1] Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.[2]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 64% of ATT&CK techniques have fewer threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.45
Tools & malwareTop 9%
Tools & malware91st percentile · 91% of ATT&CK techniques have fewer tools implementing them.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.