Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1480: Execution Guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.[1] Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.[2]

Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical Virtualization/Sandbox Evasion. While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.

Adversaries may identify and block certain user-agents to evade defenses and narrow the scope of their attack to victims and platforms on which it will be most effective. A user-agent self-identifies data such as a user's software application, operating system, vendor, and version. Adversaries may check user-agents for operating system identification and then only serve malware for the exploitable software while ignoring all other operating systems.[3]

EnterpriseT1480TechniqueObject v2.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Execution Guardrails are checks that make malicious code run only when target-specific conditions are present, such as a particular AD domain, file, network share, IP address, physical device, mutex, or user-agent. For leaders, the practical issue is that the same payload may look harmless in a sandbox or test environment but execute in production, which can create false confidence in malware analysis, email detonation, and incident triage.

Executive priority

Prioritize this as a detection and response-readiness problem rather than a simple prevention item. MITRE maps the mitigation to M1055 Do Not Mitigate, meaning direct mitigation may not be practical or may create instability; coverage depends on whether the organization can observe environment checks, suspicious conditional execution, and follow-on behavior across Windows, Linux, macOS, and ESXi. Executives should ask whether SOC and IR teams can prove what telemetry is collected from production-like environments, not only from sandboxes.

Technical view

T1480 sits under stealth and applies to ESXi, Linux, macOS, and Windows. SOC and IR teams should validate detection logic against programs or scripts that query target-specific values before continuing execution, including AD domain membership, local or external IPs, network share names, files, attached devices, user-agent or OS values, and mutex-related behavior reflected by sub-technique T1480.002. The related DET0562 detection strategy indicates ATT&CK has a detection strategy for multi-platform environmental validation, but the core technique object itself provides no official detection text, so local analytics must be derived and tested against available telemetry.

Likely telemetry

  • Process creation and command-line or script execution showing environment discovery before payload execution
  • File, path, and network share access events used as target-specific checks
  • Identity and directory context such as joined AD domain or host/domain attributes
  • Network connection metadata, local and external IP context, and HTTP user-agent strings
  • Host inventory or device attachment evidence where physical device checks are relevant

Detection direction

  • Validate that sandbox and detonation environments contain enough realistic enterprise context to expose guardrail-gated behavior; otherwise treat a non-executing sample as inconclusive.
  • Look for tight sequences of environment validation followed by execution, download, or payload activation, rather than single checks in isolation.
  • Tune carefully because many legitimate installers, enterprise agents, and management scripts check OS, domain, files, shares, devices, or user-agent values before running.
  • Use relationship context to enrich hunting: ATT&CK links this behavior to multiple software entries and groups/campaigns, but those relationships should guide prioritization, not be treated as proof of local activity.
  • Include Linux, macOS, Windows, and ESXi visibility gaps in coverage reviews; guardrails are not limited to one endpoint platform.

Mitigation priorities

  • Do not rely on direct blocking of environment checks as the primary control, consistent with MITRE’s M1055 Do Not Mitigate relationship.
  • Improve detection, monitoring, and response workflows for suspicious conditional execution and follow-on actions.
  • Harden malware analysis processes by comparing sandbox results with production-like telemetry and by documenting when a sample may be guardrail-gated.
  • Maintain complete host, identity, network, and web telemetry needed to reconstruct what condition was checked and what executed afterward.
  • Use incident response playbooks that account for payloads that may not execute outside the intended target environment.
Analyst notes and limits

Execution Guardrails matter because they can reduce adversary exposure and collateral execution while frustrating defensive analysis. Sub-techniques supplied for this object include Environmental Keying and Mutual Exclusion, and relationships show use by several ATT&CK groups, campaigns, and software families. Those relationships support threat-informed prioritization but do not establish activity in any specific environment.

The official ATT&CK detection field for T1480 is not provided. The object describes behavior and examples of guardrail values, but it does not provide vendor-specific controls, guaranteed detections, or local prevalence. Effective assessment requires local telemetry review and testing in production-like analysis conditions.

Official MITRE ATT&CK definition

Execution Guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.[1] Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.[2]

Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical Virtualization/Sandbox Evasion. While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.

Adversaries may identify and block certain user-agents to evade defenses and narrow the scope of their attack to victims and platforms on which it will be most effective. A user-agent self-identifies data such as a user's software application, operating system, vendor, and version. Adversaries may check user-agents for operating system identification and then only serve malware for the exploitable software while ignoring all other operating systems.[3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
Domain ID Name Relationship / procedure
Enterprise T1480.001 Environmental Keying Sub-technique Environmental Keying subtechnique of this object.
Enterprise T1480.002 Mutual Exclusion Sub-technique Mutual Exclusion subtechnique of this object.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0099: APT-C-36

APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.[1][2][3][4]

Group Enterprise

G1043: BlackByte

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.[1][2][3][4][5]

Group Enterprise

G0047: Gamaredon Group

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]

Malware Enterprise

S1052: DEADEYE

DEADEYE is a malware launcher that has been used by APT41 since at least May 2021. DEADEYE has variants that can either embed a payload inside a compiled binary (DEADEYE.EMBED) or append it to the end of a file (DEADEYE.APPEND).[1]

Windows
Malware Enterprise

S1179: Exbyte

Exbyte is an exfiltration tool written in Go that is uniquely associated with BlackByte operations. Observed since 2022, Exbyte transfers collected files to online file sharing and hosting services.[1]

Windows
Malware Enterprise

S9034: Tsundere Botnet

Tsundere Botnet is a botnet first reported in mid-2025 that is delivered via MSI installer or a PowerShell script. It leverages Node.js and JavaScript for payload delivery and execution, and uses smart contracts on the blockchain to host command and control (C2) addresses. Tsundere Botnet is attributed to a likely Russian-speaking threat actor.

A variant named DinDoor has been linked to MuddyWater operations and uses the Deno runtime for execution rather than Node.js.[1][2][3][4]

LinuxmacOSWindows
Malware Enterprise

S1212: RansomHub

RansomHub is a ransomware-as-a-service (RaaS) offering with Windows, ESXi, Linux, and FreeBSD versions that has been in use since at least 2024 to target organizations in multiple sectors globally. RansomHub operators may have purchased and rebranded resources from Knight (formerly Cyclops) Ransomware which shares infrastructure, feature, and code overlaps with RansomHub.[1][2]

LinuxWindows
Malware Enterprise

S9010: GlassWorm

GlassWorm is a worm that propagated through supply chain attacks by compromising repository credentials from victim environments and having malicious payloads added to those compromised accounts for distribution to victims across the various development ecosystems.[1][2][3] GlassWorm has numerous variants, including Rust binaries, encrypted JavaScript and a variant leveraging invisible Unicode characters that made reverse engineering difficult.[4][1][5] GlassWorm has employed a unique command and control (C2) methodology using Solana blockchain.[6][1] GlassWorm was first reported in October 2025.[6][1][3]

macOSWindows
Malware Enterprise

S0504: Anchor

Anchor is one of a family of backdoor malware that has been used in conjunction with TrickBot on selected high profile targets since at least 2018.[1][2]

LinuxWindows
Malware Enterprise

S0570: BitPaymer

BitPaymer is a ransomware variant first observed in August 2017 targeting hospitals in the U.K. BitPaymer uses a unique encryption key, ransom note, and contact information for each operation. BitPaymer has several indicators suggesting overlap with the Dridex malware and is often delivered via Dridex.[1]

Windows
Malware Enterprise

S1161: BPFDoor

BPFDoor is a Linux based passive long-term backdoor used by China-based threat actors. First seen in 2021, BPFDoor is named after its usage of Berkley Packet Filter (BPF) to execute single task instructions. BPFDoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP and can start local or reverse shells that bypass firewalls using iptables.[1][2]

Linux
Malware Enterprise

S1111: DarkGate

DarkGate first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named "DarkGate" by its author, DarkGate is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions.[1] DarkGate use increased significantly starting in 2022 and is under active development by its author, who provides it as a Malware-as-a-Service offering.[2]

Windows
Malware Enterprise

S1130: Raspberry Robin

Raspberry Robin is initial access malware first identified in September 2021, and active through early 2024. The malware is notable for spreading via infected USB devices containing a malicious LNK object that, on execution, retrieves remote hosted payloads for installation. Raspberry Robin has been widely used against various industries and geographies, and as a precursor to information stealer, ransomware, and other payloads such as SocGholish, Cobalt Strike, IcedID, and Bumblebee.[1][2][3] The DLL componenet in the Raspberry Robin infection chain is also referred to as "Roshtyak."[4] The name "Raspberry Robin" is used to refer to both the malware as well as the threat actor associated with its use, although the Raspberry Robin operators are also tracked as Storm-0856 by some vendors.[5]

Windows
Relationship explorer

All related ATT&CK context

uses · Malware S1052: DEADEYE Enterprise uses · Malware S1179: Exbyte Enterprise uses · Malware S1149: CHIMNEYSWEEP Enterprise uses · Malware S1239: TONESHELL Enterprise uses · Malware S9034: Tsundere Botnet Enterprise uses · Malware S1212: RansomHub Enterprise uses · Malware S9010: GlassWorm Enterprise uses · Malware S0504: Anchor Enterprise uses · Malware S0570: BitPaymer Enterprise uses · Malware S1161: BPFDoor Enterprise uses · Malware S1111: DarkGate Enterprise mitigates · Mitigation M1055: Do Not Mitigate Enterprise uses · Malware S1130: Raspberry Robin Enterprise uses · Malware S0636: VaporRage Enterprise uses · Malware S0634: EnvyScout Enterprise uses · Malware S1185: LightSpy Enterprise uses · Malware S0678: Torisma Enterprise uses · Malware S1035: Small Sieve Enterprise uses · Malware S1183: StrelaStealer Enterprise uses · Tool S9003: evilginx2 Enterprise uses · Malware S9020: LODEINFO Enterprise uses · Campaign C0047: RedDelta Modified PlugX Infection Chain Operations Enterprise uses · Malware S9039: LazyWiper Enterprise uses · Malware S1202: LockBit 3.0 Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1055: Do Not Mitigate

The Do Not Mitigate category highlights scenarios where attempting to mitigate a specific technique may inadvertently increase the organization's security risk or operational instability. This could happen due to the complexity of the system, the integration of critical processes, or the potential for introducing new vulnerabilities. Instead of direct mitigation, these situations may call for alternative strategies such as detection, monitoring, or response. The Do Not Mitigate category underscores the importance of assessing the trade-offs between mitigation efforts and overall system integrity. This mitigation can be implemented through the following measures:

Complex Systems Where Mitigation is Risky:

- Interpretation: In certain systems, direct mitigation could introduce new risks, especially if the system is highly interconnected or complex, such as in legacy industrial control systems (ICS). Patching or modifying these systems could result in unplanned downtime, disruptions, or even safety risks. - Use Case: In a power grid control system, attempting to patch or disable certain services related to device communications might disrupt critical operations, leading to unintended service outages.

Risk of Reducing Security Coverage:

- Interpretation: In some cases, mitigating a technique might reduce the visibility or effectiveness of other security controls, limiting an organization’s ability to detect broader attacks. - Use Case: Disabling script execution on a web server to mitigate potential PowerShell-based attacks could interfere with legitimate administrative operations that rely on scripting, while attackers may still find alternate ways to execute code.

Introduction of New Vulnerabilities:

- Interpretation: In highly sensitive or tightly controlled environments, implementing certain mitigations might create vulnerabilities in other parts of the system. For instance, disabling default security mechanisms in an attempt to resolve compatibility issues may open the system to exploitation. - Use Case: Disabling certificate validation to resolve internal communication issues in a secure environment could lead to man-in-the-middle attacks, creating a greater vulnerability than the original problem.

Negative Impact on Performance and Availability:

- Interpretation: Mitigations that involve removing or restricting system functionalities can have unintended consequences for system performance and availability. Some mitigations, while effective at blocking certain attacks, may introduce performance bottlenecks or compromise essential operations. - Use Case: Implementing high levels of encryption to mitigate data theft might result in significant performance degradation in systems handling large volumes of real-time transactions.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
37a24e0d2574b067...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.0 Current bundle 37a24e0d2574…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye Kevin Mandia Guardrails

    Shoorbajee, Z. (2018, June 1). Playing nice? FireEye CEO says U.S. malware is more restrained than adversaries'. Retrieved January 17, 2019.

    Open source URL
  2. [2]
    FireEye Outlook Dec 2019

    McWhirt, M., Carr, N., Bienstock, D. (2019, December 4). Breaking the Rules: A Tough Outlook for Home Page Attacks (CVE-2017-11774). Retrieved June 23, 2020.

    Open source URL
  3. [3]
    Trellix-Qakbot

    Pham Duy Phuc, John Fokker J.E., Alejandro Houspanossian and Mathanraj Thangaraju. (2023, March 7). Qakbot Evolves to OneNote Malware Distribution. Retrieved June 7, 2024.

    Open source URL
  4. [4]
    mitre-attack T1480
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use