Cross-source coverage

T1480 / ATT&CK

Execution Guardrails

1 rule across 1 source.

From MITRE ATT&CK 19.2

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign. Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.

Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical Virtualization/Sandbox Evasion. While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.

Adversaries may identify and block certain user-agents to evade defenses and narrow the scope of their attack to victims and platforms on which it will be most effective. A user-agent self-identifies data such as a user's software application, operating system, vendor, and version. Adversaries may check user-agents for operating system identification and then only serve malware for the exploitable software while ignoring all other operating systems.

Tactics
Stealth
Platforms
ESXi · Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:SysmonWinEventLog:WMIWinEventLog:PowerShellauditd:SYSCALLauditd:PROCTITLElinux:syslogmacos:unifiedlogfs:fileeventsesxi:shellesxi:hostd

How MITRE says to detect it DET0562

Multi-Platform Execution Guardrails Environmental Validation Detection Strategy

Windows Analytic 1551

Windows environmental validation behavioral chain: (1) Rapid system discovery reconnaissance through WMI queries, registry enumeration, and network share discovery, (2) Environment-specific artifact collection (hostname, domain, IP addresses, installed software, hardware identifiers), (3) Cryptographic operations or conditional logic based on collected environmental values, (4) Selective payload execution contingent on environmental validation results, (5) Temporal correlation between discovery activities and subsequent execution or network communication

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Security EventCode=4648
  • WinEventLog:Security EventCode=4624, 4648
  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Sysmon EventCode=7
  • WinEventLog:Sysmon EventCode=8
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=13, 14
  • WinEventLog:WMI EventCode=5857, 5858, 5860, 5861
  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106

Linux Analytic 1552

Linux environmental validation behavioral chain: (1) Intensive system enumeration through command execution (uname, hostname, ifconfig, lsblk, mount), (2) File system reconnaissance targeting specific paths, network configurations, and installed packages, (3) Process and user enumeration to validate target environment characteristics, (4) Conditional script execution or binary activation based on environmental criteria, (5) Network connectivity validation and external IP address resolution for geolocation verification

  • auditd:SYSCALL execve
  • auditd:SYSCALL open
  • auditd:SYSCALL openat,connect -k discovery
  • auditd:PROCTITLE command-line execution patterns for system discovery utilities (uname, hostname, ifconfig, netstat, lsof, ps, mount)
  • linux:syslog authentication and authorization events during environmental validation phase

macOS Analytic 1553

macOS environmental validation behavioral chain: (1) System profiling through system_profiler, sysctl, and hardware discovery commands, (2) Network interface and configuration enumeration for geolocation and network environment validation, (3) Application installation and version discovery for software environment fingerprinting, (4) Security feature detection (SIP, Gatekeeper, XProtect status), (5) Conditional payload execution based on macOS-specific environmental criteria and System Integrity Protection bypass validation

  • macos:unifiedlog process execution events for system discovery utilities (system_profiler, sysctl, networksetup, ioreg) with parameter analysis
  • fs:fileevents File system access events with kFSEventStreamEventFlagItemRemoved, kFSEventStreamEventFlagItemRenamed flags for environmental artifact collection (/System/Library, /usr/sbin, plist files)

ESXi Analytic 1554

ESXi hypervisor environmental validation behavioral chain: (1) Virtual machine inventory and configuration enumeration through vim-cmd and esxcli commands, (2) Host hardware and network configuration discovery for hypervisor environment validation, (3) Datastore and storage configuration reconnaissance, (4) vCenter connectivity and cluster membership validation, (5) Selective malware deployment based on virtualization infrastructure characteristics and target VM validation

  • esxi:shell shell command execution for system discovery (vim-cmd, esxcli, vmware-cmd) targeting VM inventory and host configuration
  • esxi:hostd host daemon events related to VM operations and configuration queries during reconnaissance

View on attack.mitre.org ↗

splunk/security_content

1 rule
Detection Severity Format
Linux Auditd AI CLI Permission Override Activated Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.