Skip to content

T1480 Execution Guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.1 Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.2

Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical Virtualization/Sandbox Evasion. While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.

Item Value
ID T1480
Sub-techniques T1480.001
Tactics TA0005
Platforms Linux, Windows, macOS
Permissions required User
Version 1.1
Created 31 January 2019
Last Modified 09 June 2021

Procedure Examples

ID Name Description
S0504 Anchor Anchor can terminate itself if specific execution flags are not present.8
S0570 BitPaymer BitPaymer compares file names and paths to a list of excluded names and directory names during encryption.5
S0635 BoomBox BoomBox can check its current working directory and for the presence of a specific file and terminate if specific values are not found.3
S0634 EnvyScout EnvyScout can call window.location.pathname to ensure that embedded files are being executed from the C: drive, and will terminate if they are not.3
S0637 NativeZone NativeZone can check for the presence of KM.EkeyAlmaz1C.dll and will halt execution unless it is in the same directory as the rest of the malware’s components.36
S0603 Stuxnet Stuxnet checks for specific operating systems on 32-bit machines, Registry keys, and dates for vulnerabilities, and will exit execution if the values are not met.9
S0562 SUNSPOT SUNSPOT only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.7
S0678 Torisma Torisma is only delivered to a compromised host if the victim’s IP address is on an allow-list.4
S0636 VaporRage VaporRage has the ability to check for the presence of a specific DLL and terminate if it is not found.3

Mitigations

ID Mitigation Description
M1055 Do Not Mitigate Execution Guardrails likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised. If targeted, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0009 Process Process Creation

References

Back to top