CyberStack

MITRE ATT&CK / Techniques / T1480

Execution Guardrails

ID
T1480
Tactics
TA0005 Stealth
Platforms
ESXi, Linux, macOS, Windows
Data sources
Process Creation, User Account Authentication, Logon Session Creation, Network Connection Creation, Module Load, Process Modification, File Creation, Windows Registry Key Modification, WMI Creation, Command Execution, File Access
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.[1] Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.[2]

Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical Virtualization/Sandbox Evasion. While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.

Adversaries may identify and block certain user-agents to evade defenses and narrow the scope of their attack to victims and platforms on which it will be most effective. A user-agent self-identifies data such as a user's software application, operating system, vendor, and version. Adversaries may check user-agents for operating system identification and then only serve malware for the exploitable software while ignoring all other operating systems.[3]

Sub-techniques (2)

Detection

Mitigations (1)

M1055 Do Not Mitigate

Execution Guardrails likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised. If targeted, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised.

Groups (5)

Software (46)

References

  1. FireEye Kevin Mandia Guardrails
  2. FireEye Outlook Dec 2019
  3. Trellix-Qakbot