{"id":"T1480","name":"Execution Guardrails","url":"https://attack.mitre.org/techniques/T1480","tactics":["stealth"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0562","stix_id":"x-mitre-detection-strategy--99bdd6d6-ebef-40e2-83d2-2f39408c82e3","name":"Multi-Platform Execution Guardrails Environmental Validation Detection Strategy","url":"https://attack.mitre.org/detectionstrategies/DET0562","analytics":[{"id":"AN1551","stix_id":"x-mitre-analytic--8089daf3-72b0-4714-b800-2856f27dc21c","name":"Analytic 1551","description":"Windows environmental validation behavioral chain: (1) Rapid system discovery reconnaissance through WMI queries, registry enumeration, and network share discovery, (2) Environment-specific artifact collection (hostname, domain, IP addresses, installed software, hardware identifiers), (3) Cryptographic operations or conditional logic based on collected environmental values, (4) Selective payload execution contingent on environmental validation results, (5) Temporal correlation between discovery activities and subsequent execution or network communication","url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1551","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4648","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=8","data_component":"DC0020","data_component_name":"Process Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:WMI","channel":"EventCode=5857, 5858, 5860, 5861","data_component":"DC0008","data_component_name":"WMI Creation","log_source_slug":"wineventlog-wmi"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"DiscoveryTimeWindow","description":"Maximum time window for correlating multiple discovery activities indicating reconnaissance phase - adjust based on normal system behavior (default: 300 seconds)"},{"field":"DiscoveryActivityThreshold","description":"Minimum number of different discovery techniques within time window to trigger detection - balance between false positives and coverage (default: 4 activities)"},{"field":"CryptographicLibraryWhitelist","description":"Approved cryptographic libraries and modules for legitimate organizational use - maintain based on approved software inventory"},{"field":"WMIQueryComplexityThreshold","description":"Complexity score for WMI queries indicating reconnaissance vs. legitimate administration - tune based on administrative patterns"},{"field":"EnvironmentalArtifactList","description":"Environment-specific values commonly targeted by guardrails (hostnames, domains, network shares) - customize for organizational environment"},{"field":"ExecutionDelayBaseline","description":"Statistical baseline for normal delay between discovery and execution activities - establish through historical analysis"}],"live":true,"detection_strategies":["DET0562"],"techniques":["T1480"]},{"id":"AN1552","stix_id":"x-mitre-analytic--31027842-f02c-4bc3-8cd6-3e4b533da5ac","name":"Analytic 1552","description":"Linux environmental validation behavioral chain: (1) Intensive system enumeration through command execution (uname, hostname, ifconfig, lsblk, mount), (2) File system reconnaissance targeting specific paths, network configurations, and installed packages, (3) Process and user enumeration to validate target environment characteristics, (4) Conditional script execution or binary activation based on environmental criteria, (5) Network connectivity validation and external IP address resolution for geolocation verification","url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1552","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"open","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"openat,connect -k discovery","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:PROCTITLE","channel":"command-line execution patterns for system discovery utilities (uname, hostname, ifconfig, netstat, lsof, ps, mount)","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-proctitle"},{"name":"linux:syslog","channel":"authentication and authorization events during environmental validation phase","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"SystemDiscoveryCommandList","description":"Linux commands commonly used for system reconnaissance - customize based on environment-specific discovery patterns"},{"field":"ReconnaissanceBurstThreshold","description":"Number of discovery commands within time window indicating reconnaissance burst - tune based on legitimate administrative activity"},{"field":"EnvironmentalCheckPatterns","description":"File paths and system properties commonly validated by environmental keying - adapt to organizational infrastructure"},{"field":"NetworkDiscoveryBaseline","description":"Normal network discovery activity patterns to distinguish from malicious reconnaissance"},{"field":"ConditionalExecutionIndicators","description":"Script patterns and conditional logic indicating environment-based execution decisions"}],"live":true,"detection_strategies":["DET0562"],"techniques":["T1480"]},{"id":"AN1553","stix_id":"x-mitre-analytic--65abf5f4-ddb9-4eac-a926-1bef5d6b5c63","name":"Analytic 1553","description":"macOS environmental validation behavioral chain: (1) System profiling through system_profiler, sysctl, and hardware discovery commands, (2) Network interface and configuration enumeration for geolocation and network environment validation, (3) Application installation and version discovery for software environment fingerprinting, (4) Security feature detection (SIP, Gatekeeper, XProtect status), (5) Conditional payload execution based on macOS-specific environmental criteria and System Integrity Protection bypass validation","url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1553","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process execution events for system discovery utilities (system_profiler, sysctl, networksetup, ioreg) with parameter analysis","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"fs:fileevents","channel":"File system access events with kFSEventStreamEventFlagItemRemoved, kFSEventStreamEventFlagItemRenamed flags for environmental artifact collection (/System/Library, /usr/sbin, plist files)","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"fs-fileevents"}],"mutable_elements":[{"field":"MacOSDiscoveryTools","description":"macOS-specific system discovery utilities commonly used for environmental validation"},{"field":"SecurityFeatureEnumeration","description":"Security features and configurations typically validated by macOS execution guardrails"},{"field":"HardwareFingerprintBaseline","description":"Normal hardware discovery patterns to distinguish from environmental validation attempts"},{"field":"SIPBypassIndicators","description":"Patterns indicating attempts to validate or bypass System Integrity Protection"}],"live":true,"detection_strategies":["DET0562"],"techniques":["T1480"]},{"id":"AN1554","stix_id":"x-mitre-analytic--1cd8c844-575a-44be-9fee-80cd988dc781","name":"Analytic 1554","description":"ESXi hypervisor environmental validation behavioral chain: (1) Virtual machine inventory and configuration enumeration through vim-cmd and esxcli commands, (2) Host hardware and network configuration discovery for hypervisor environment validation, (3) Datastore and storage configuration reconnaissance, (4) vCenter connectivity and cluster membership validation, (5) Selective malware deployment based on virtualization infrastructure characteristics and target VM validation","url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1554","platforms":["ESXi"],"log_source_references":[{"name":"esxi:shell","channel":"shell command execution for system discovery (vim-cmd, esxcli, vmware-cmd) targeting VM inventory and host configuration","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-shell"},{"name":"esxi:hostd","channel":"host daemon events related to VM operations and configuration queries during reconnaissance","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"ESXiDiscoveryCommands","description":"ESXi commands commonly used for hypervisor and VM reconnaissance"},{"field":"VMInventoryEnumerationThreshold","description":"Number of VM inventory queries within time window indicating reconnaissance activity"},{"field":"HypervisorEnvironmentBaseline","description":"Normal hypervisor management activity patterns for distinguishing malicious reconnaissance"},{"field":"DatastoreAccessPatterns","description":"Unusual datastore access patterns indicating environmental validation or target selection"}],"live":true,"detection_strategies":["DET0562"],"techniques":["T1480"]}],"live":true,"version":"1.0","techniques":["T1480"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}