Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Execution Guardrails

Sub-techniques (2)

ID	Name
.001	Environmental Keying
.002	Mutual Exclusion

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019) Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical Virtualization/Sandbox Evasion. While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match. Adversaries may identify and block certain user-agents to evade defenses and narrow the scope of their attack to victims and platforms on which it will be most effective. A user-agent self-identifies data such as a user's software application, operating system, vendor, and version. Adversaries may check user-agents for operating system identification and then only serve malware for the exploitable software while ignoring all other operating systems.(Citation: Trellix-Qakbot)

ID: T1480

Sub-techniques: .001 .002

Tactic(s): Defense Evasion

Platforms: ESXi, Linux, macOS, Windows

Data Sources: Command: Command Execution, Process: Process Creation

Version: 1.3

Created: 31 Jan 2019

Last Modified: 15 Apr 2025

Name	Description
Procedure Examples
DEADEYE	DEADEYE can ensure it executes only on intended systems by identifying the victim's volume serial number, hostname, and/or DNS domain.(Citation: Mandiant APT41)
Exbyte	Exbyte checks for the presence of a configuration file before completing execution.(Citation: Microsoft BlackByte 2023)
CHIMNEYSWEEP	CHIMNEYSWEEP can execute a task which leads to execution if it finds a process name containing “creensaver.”(Citation: Mandiant ROADSWEEP August 2022)
RansomHub	RansomHub will terminate without proceeding to encryption if the infected machine is on a list of allowlisted machines specified in its configuration.(Citation: Group-IB RansomHub FEB 2025)
Anchor	Anchor can terminate itself if specific execution flags are not present.(Citation: Cyberreason Anchor December 2019)
BitPaymer	BitPaymer compares file names and paths to a list of excluded names and directory names during encryption.(Citation: Crowdstrike Indrik November 2018)
BPFDoor	BPFDoor creates a zero byte PID file at `/var/run/haldrund.pid`. BPFDoor uses this file to determine if it is already running on a system to ensure only one instance is executing at a time.(Citation: Sandfly BPFDoor 2022)
DarkGate	DarkGate uses per-victim links for hosting malicious archives, such as ZIP files, in services such as SharePoint to prevent other entities from retrieving them.(Citation: Trellix Darkgate 2023)
Raspberry Robin	Raspberry Robin will check for the presence of several security products on victim machines and will avoid UAC bypass mechanisms if they are identified.(Citation: TrendMicro RaspberryRobin 2022) Raspberry Robin can use specific cookie values in HTTP requests to command and control infrastructure to validate that requests for second stage payloads originate from the initial downloader script.(Citation: HP RaspberryRobin 2024)
VaporRage	VaporRage has the ability to check for the presence of a specific DLL and terminate if it is not found.(Citation: MSTIC Nobelium Toolset May 2021)
EnvyScout	EnvyScout can call `window.location.pathname` to ensure that embedded files are being executed from the C: drive, and will terminate if they are not.(Citation: MSTIC Nobelium Toolset May 2021)
LightSpy	On macOS, LightSpy checks the existence of a process identification number (PID) file, `/Users/Shared/irc.pid`, to verify if LightSpy is currently running.(Citation: Huntress LightSpy macOS 2024)
Torisma	Torisma is only delivered to a compromised host if the victim's IP address is on an allow-list.(Citation: McAfee Lazarus Nov 2020)
Small Sieve	Small Sieve can only execute correctly if the word `Platypus` is passed to it on the command line.(Citation: NCSC GCHQ Small Sieve Jan 2022)
StrelaStealer	StrelaStealer variants only execute if the keyboard layout or language matches a set list of variables.(Citation: Fortgale StrelaStealer 2023)(Citation: IBM StrelaStealer 2024)
	Mustang Panda included the use of Cloudflare geofencing mechanisms to limit payload download activity during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)
LockBit 3.0	LockBit 3.0 can make execution dependent on specific parameters including a unique passphrase and the system language of the targeted host not being found on a set exclusion list. (Citation: Joint Cybersecurity Advisory LockBit JUN 2023)(Citation: Sentinel Labs LockBit 3.0 JUL 2022)(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)
Stuxnet	Stuxnet checks for specific operating systems on 32-bit machines, Registry keys, and dates for vulnerabilities, and will exit execution if the values are not met.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)
SUNSPOT	SUNSPOT only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.(Citation: CrowdStrike SUNSPOT Implant January 2021)
Apostle	Apostle's ransomware variant requires that a base64-encoded argument is passed when executed, that is used as the Public Key for subsequent encryption operations. If Apostle is executed without this argument, it automatically runs a self-delete function.(Citation: SentinelOne Agrius 2021)
LunarLoader	LunarLoader can use the DNS domain name of a compromised host to create a decryption key to ensure a malicious payload can only execute against the intended targets.(Citation: ESET Turla Lunar toolset May 2024)
BoomBox	BoomBox can check its current working directory and for the presence of a specific file and terminate if specific values are not found.(Citation: MSTIC Nobelium Toolset May 2021)
StealBit	StealBit will execute an empty infinite loop if it detects it is being run in the context of a debugger.(Citation: Cybereason StealBit Exfiltration Tool)
LockBit 2.0	LockBit 2.0 will not execute on hosts where the system language is set to a language spoken in the Commonwealth of Independent States region.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Palo Alto Lockbit 2.0 JUN 2022)
NativeZone	NativeZone can check for the presence of KM.EkeyAlmaz1C.dll and will halt execution unless it is in the same directory as the rest of the malware's components.(Citation: MSTIC Nobelium Toolset May 2021)(Citation: SentinelOne NobleBaron June 2021)
ROADSWEEP	ROADSWEEP requires four command line arguments to execute correctly, otherwise it will produce a message box and halt execution.(Citation: Mandiant ROADSWEEP August 2022)(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)
BlackByte Ransomware	BlackByte Ransomware creates a mutex value with a hard-coded name, and terminates if that mutex already exists on the victim system. BlackByte Ransomware checks the system language to see if it matches one of a list of hard-coded values; if a match is found, the malware will terminate.(Citation: Trustwave BlackByte 2021)
ShrinkLocker	ShrinkLocker will exit its "main" function if the victim domain name does not match provided criteria.(Citation: Splunk ShrinkLocker 2024)
Sagerunex	Sagerunex uses a "servicemain" function to verify its environment to ensure it can only be executed as a service, as well as the existence of a configuration file in a specified directory.(Citation: Cisco LotusBlossom 2025)
BlackByte	BlackByte stopped execution if identified language settings on victim machines was Russian or one of several language associated with former Soviet republics.(Citation: Picus BlackByte 2022) BlackByte has used ransomware variants requiring a key passed on the command line for the malware to execute.(Citation: Cisco BlackByte 2024)
BOLDMOVE	BOLDMOVE verifies it is executing from a specific path during execution.(Citation: Google Cloud BOLDMOVE 2023)
Gamaredon Group	Gamaredon Group has used geoblocking to limit downloads of the malicious file to specific geographic locations.(Citation: unit42_gamaredon_dec2022)
Akira _v2	Akira _v2 will fail to execute if the targeted `/vmfs/volumes/` path does not exist or is not defined.(Citation: Cisco Akira Ransomware OCT 2024)

Mitigation	Description
Mitigations
Do Not Mitigate	The Do Not Mitigate category highlights scenarios where attempting to mitigate a specific technique may inadvertently increase the organization's security risk or operational instability. This could happen due to the complexity of the system, the integration of critical processes, or the potential for introducing new vulnerabilities. Instead of direct mitigation, these situations may call for alternative strategies such as detection, monitoring, or response. The Do Not Mitigate category underscores the importance of assessing the trade-offs between mitigation efforts and overall system integrity. This mitigation can be implemented through the following measures: Complex Systems Where Mitigation is Risky: - Interpretation: In certain systems, direct mitigation could introduce new risks, especially if the system is highly interconnected or complex, such as in legacy industrial control systems (ICS). Patching or modifying these systems could result in unplanned downtime, disruptions, or even safety risks. - Use Case: In a power grid control system, attempting to patch or disable certain services related to device communications might disrupt critical operations, leading to unintended service outages. Risk of Reducing Security Coverage: - Interpretation: In some cases, mitigating a technique might reduce the visibility or effectiveness of other security controls, limiting an organization’s ability to detect broader attacks. - Use Case: Disabling script execution on a web server to mitigate potential PowerShell-based attacks could interfere with legitimate administrative operations that rely on scripting, while attackers may still find alternate ways to execute code. Introduction of New Vulnerabilities: - Interpretation: In highly sensitive or tightly controlled environments, implementing certain mitigations might create vulnerabilities in other parts of the system. For instance, disabling default security mechanisms in an attempt to resolve compatibility issues may open the system to exploitation. - Use Case: Disabling certificate validation to resolve internal communication issues in a secure environment could lead to man-in-the-middle attacks, creating a greater vulnerability than the original problem. Negative Impact on Performance and Availability: - Interpretation: Mitigations that involve removing or restricting system functionalities can have unintended consequences for system performance and availability. Some mitigations, while effective at blocking certain attacks, may introduce performance bottlenecks or compromise essential operations. - Use Case: Implementing high levels of encryption to mitigate data theft might result in significant performance degradation in systems handling large volumes of real-time transactions.
Environmental Keying Mitigation	This technique likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised. If targeted, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised.

Detection

Detecting the use of guardrails may be difficult depending on the implementation. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.