Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of Execution Guardrails that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.[1]
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has encrypted payloads using the Data Protection API (DPAPI), which relies on keys tied to specific user accounts on specific machines. APT41 has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.1
Has been observed utilizing environmental keying in payload delivery.12
All 2 groups for this technique
8 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has generated unique GUIDs to identify victim devices.123 TONESHELL has leveraged environmental keying in payload delivery using the victim computer name and other configuration values.4 TONESHELL has also tracked IDs associated with reverse shell subprocesses to manage interactions and terminations from C2.13
Has utilized environmental keying in the payload to include the victim volume serial number, computer name, username, and machine’s tick count.1
Stops execution if the infected system language matches one of several languages, with various versions referencing: Georgian, Kazakh, Uzbek, Tajik, Russian, Ukrainian, Belarussian, and Slovenian.12
Can store its final payload in the Registry under $HKLM\SOFTWARE\Classes\Interface\ encrypted with a dynamically generated key based on the drive’s serial number.1
Can use the volume serial number from a target host to generate a unique XOR key for the next stage payload.1
Relies on a specific victim hostname to execute and decrypt important strings.1
All 8 software entries for this technique · 6 newest in this preview
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN1305 · Windows
Windows-specific environmental keying behavioral chain: (1) Rapid system information discovery through multiple techniques (WMI queries, registry enumeration, network share discovery, hostname/domain checks), (2) Target validation through specific environmental artifact collection (AD domain membership, network topology, installed software versions), (3) Cryptographic operation correlation indicating payload decryption based on collected environmental values, (4) Subsequent malicious code execution following successful environmental validation, (5) Temporal clustering of discovery activities suggesting automated environmental assessment
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| WMI CreationDC0008 | WinEventLog:WMI | EventCode=5857, 5858, 5860, 5861 |
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=25 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DiscoveryTimeWindow | Time window for correlating multiple discovery activities as part of environmental assessment - adjust based on observed attack patterns and system performance (default: 300 seconds) |
| CriticalDiscoveryThreshold | Minimum number of distinct discovery techniques within time window to trigger detection - tune based on environment's normal administrative activity levels |
| TargetSpecificArtifacts | Organization-specific environmental elements that adversaries might target (domain names, network shares, specific hostnames, software versions) |
| CryptographicIndicatorPatterns | Process names, command lines, and API calls indicating potential decryption operations - customize based on observed cryptographic tool usage in environment |
| LegitimateAdminAccounts | User accounts authorized to perform extensive system discovery - maintain current list to reduce false positives from legitimate administrative activities |
| BusinessHoursBaseline | Normal business hours for risk scoring adjustment - discovery activities outside these hours receive higher risk scores |
| WMIQueryComplexityThreshold | Complexity metric for WMI queries to identify sophisticated environmental assessment versus simple system checks |
AN1306 · Linux
Linux environmental keying behavioral chain: (1) System information gathering through native commands (uname, hostname, id, whoami, ifconfig/ip) and file system enumeration, (2) Network configuration discovery (route tables, DNS settings, network interfaces), (3) Filesystem and mount point analysis for target-specific directories or devices, (4) Process and service enumeration to identify target-specific software, (5) Cryptographic library usage correlation with collected environmental data, (6) Payload execution following successful environmental validation
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | linux:osquery | process_events |
| File AccessDC0055 | linux:syslog | kernel messages related to cryptographic operations, module loading, and filesystem access patterns |
| Command ExecutionDC0064 | auditd:SYSCALL | execve syscalls for discovery commands (uname, hostname, id, whoami, ps, netstat, mount) with command-line parameter analysis |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DiscoveryCommandSequenceThreshold | Number of distinct discovery commands within time window to trigger detection - adjust based on normal system administration patterns in environment |
| ProcessAncestryDepth | Depth of process parent-child relationships to analyze for discovery activity clustering - balance between detection efficacy and performance |
| CryptographicLibraryIndicators | Shared libraries and system calls indicating cryptographic operations (libcrypto, libssl, openssl) - customize based on environment-specific crypto tools |
| TargetSpecificFilesystems | Organization-specific mount points, network filesystems, or device paths that adversaries might validate against |
| AuthorizedDiscoveryUsers | User accounts and service accounts authorized for extensive system discovery operations - maintain for false positive reduction |
| NetworkConfigurationBaseline | Normal network interface configurations and routing tables to identify anomalous network discovery patterns |
| ContainerContextIdentifiers | Container runtime identifiers and namespace patterns to detect environmental assessment targeting container environments |
AN1307 · macOS
macOS environmental keying behavioral chain: (1) System information discovery through native utilities (system_profiler, sw_vers, hostname, dscl) and Security framework queries, (2) Hardware and software enumeration including serial numbers, installed applications, and system versions, (3) Network configuration assessment (networksetup, scutil) and wireless network discovery, (4) Keychain and security context validation, (5) Unified Logs correlation with cryptographic framework usage (CommonCrypto, Security.framework), (6) Application bundle execution following environmental validation
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | process execution events for discovery utilities (system_profiler, sw_vers, dscl, networksetup) with command-line parameter analysis |
| File AccessDC0055 | fs:fsevents | file system events indicating access to system configuration files and environmental information sources |
| Command ExecutionDC0064 | macos:unifiedlog | Security framework operations including keychain access, cryptographic operations, and certificate validation |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SystemProfilerDataTypes | Specific system_profiler data types that adversaries commonly target (SPHardwareDataType, SPSoftwareDataType, SPNetworkDataType) - customize based on threat intelligence |
| SecurityFrameworkOperationPatterns | Security.framework and CommonCrypto API usage patterns indicating cryptographic operations for environmental keying |
| UnifiedLogRetentionWindow | Time window for correlating discovery activities with subsequent cryptographic operations - balance between detection coverage and log volume |
| ApplicationBundleValidationPaths | Specific application bundle paths and identifiers that might be subject to environmental validation |
| NetworkConfigurationIdentifiers | Organization-specific network configurations, WiFi SSIDs, and network services that adversaries might validate against |
| MacOSVersionBaseline | Expected macOS versions and configurations in environment to identify version-specific environmental targeting |
| FSEventsFilteringCriteria | File system event filtering criteria to focus on security-relevant file access patterns while managing event volume |
Environmental Keying likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised via confusion of keys by the adversary. Mitigation of this technique is also unlikely to be feasible within most contexts because there are no standard attributes from which an adversary may derive keys. If targeted, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised.
No detection rules are mapped to this technique yet.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|