T1480

Execution Guardrails

Defense Evasion Last updated:

Adversaries may use execution guardrails to constrain execution or actions based on adversary-supplied and environment-specific conditions expected to be present on the target. Guardrails ensure a payload only executes against an intended target, reducing collateral damage from an adversary's campaign. Values used as guardrails include specific volume serial numbers, hostnames, Active Directory domain membership, IP addresses, the presence of specific files or processes, and specific command-line arguments. This technique is distinct from Virtualization/Sandbox Evasion (T1497): sandbox evasion avoids any analysis environment, while guardrails require a specific target environment to be confirmed before execution proceeds. Real-world examples include DEADEYE verifying volume serial number and hostname, Exbyte checking for a configuration file before completing execution, TONESHELL checking for ESET security processes (ekrn.exe, egui.exe) before injecting into waitfor.exe, BPFDoor using a PID mutex file at /var/run/haldrund.pid, RansomHub terminating if the machine appears on an allowlist, and Small Sieve requiring the literal keyword 'Platypus' as a command-line argument.

What is T1480 Execution Guardrails?

Execution Guardrails (T1480) maps to the Defense Evasion tactic — the adversary is trying to avoid being detected in MITRE ATT&CK.

This page provides production-ready detection logic for Execution Guardrails, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Defense Evasion
Technique
T1480 Execution Guardrails
Canonical reference
https://attack.mitre.org/techniques/T1480/
Microsoft Sentinel / Defender
kusto 
// T1480 Execution Guardrails — Environmental fingerprinting from suspicious execution contexts
// Detects processes performing target-validation checks (volume serial, hostname/domain, network identity,
// file presence, process presence) launched from LOLBin or script host parents.
// These behaviors are consistent with guardrail-enabled malware verifying it is on an intended target.
let ScriptHostsAndLolbins = dynamic([
    "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe",
    "regsvr32.exe", "msiexec.exe", "installutil.exe", "cmstp.exe",
    "powershell.exe", "pwsh.exe"
]);
let VolumeSerialPatterns = dynamic([
    "VolumeSerialNumber", "Win32_LogicalDisk",
    "vol c:", "vol d:", "vol e:", "fsutil volume"
]);
let DomainHostnamePatterns = dynamic([
    "Win32_ComputerSystem", "DNSDomain", "userdnsdomain",
    "logonserver", "nltest /domain_trusts", "nltest /dclist"
]);
let NetworkFingerprintPatterns = dynamic([
    "Win32_NetworkAdapterConfiguration", "MACAddress",
    "DefaultIPGateway", "Win32_NetworkAdapter"
]);
let FilePresencePatterns = dynamic([
    "if exist", "if not exist", "Test-Path",
    "haldrund.pid", "irc.pid"
]);
let ProcessPresencePatterns = dynamic([
    "ekrn.exe", "egui.exe",
    "tasklist /FI", "Get-Process -Name"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (ScriptHostsAndLolbins)
    or (FileName in~ ("wmic.exe", "nltest.exe") and InitiatingProcessFileName in~ (ScriptHostsAndLolbins))
| where ProcessCommandLine has_any (VolumeSerialPatterns)
    or ProcessCommandLine has_any (DomainHostnamePatterns)
    or ProcessCommandLine has_any (NetworkFingerprintPatterns)
    or ProcessCommandLine has_any (FilePresencePatterns)
    or ProcessCommandLine has_any (ProcessPresencePatterns)
| extend GuardrailType = case(
    ProcessCommandLine has_any (VolumeSerialPatterns), "VolumeSerial",
    ProcessCommandLine has_any (DomainHostnamePatterns), "DomainOrHostname",
    ProcessCommandLine has_any (NetworkFingerprintPatterns), "NetworkIdentity",
    ProcessCommandLine has_any (FilePresencePatterns), "FilePresence",
    ProcessCommandLine has_any (ProcessPresencePatterns), "ProcessPresence",
    "Unknown"
)
| extend RiskScore = case(
    GuardrailType == "VolumeSerial", 3,
    GuardrailType == "ProcessPresence" and ProcessCommandLine has_any ("ekrn.exe", "egui.exe"), 3,
    GuardrailType in ("DomainOrHostname", "FilePresence", "ProcessPresence"), 2,
    1
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         GuardrailType, RiskScore
| sort by RiskScore desc, Timestamp desc

Detects execution guardrail patterns where processes launched from suspicious parent executables (LOLBins, script hosts) query environment-specific properties such as volume serial numbers, domain/hostname, network adapter MAC address, file presence, or named process presence. These fingerprinting behaviors from script host or LOLBin parents are consistent with targeted malware validating the intended victim environment before releasing a payload. Volume serial checks and security-product process checks receive the highest risk score (3) due to near-zero legitimate use from these parent contexts. Domain/hostname and file presence checks score 2. Uses has_any for case-insensitive partial matching.

medium severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • Legitimate deployment scripts (SCCM, Group Policy) that check domain membership or hostname before applying configuration — typically parent process is svchost.exe or ccmexec.exe, not a LOLBin
  • Monitoring and inventory agents (Tanium, Qualys, SolarWinds) that enumerate network adapter properties or system info — whitelist by exact parent process name
  • IT automation tools (PDQ Deploy, Altiris) that verify target environment before running installation packages
  • Developer environment setup scripts that check for specific environments (dev/staging/prod) using hostname or domain name
  • Backup software (Veeam, Acronis) that queries volume serial numbers for backup source identification — typically runs as a known service account

Sigma rule & cross-platform mapping

The detection logic for Execution Guardrails (T1480) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1480 Sigma rules on detection.fyi

Platform-specific guides for T1480

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (9)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Volume Serial Number Enumeration via WMIC

    Expected signal: Sysmon Event ID 1: Process Create with Image containing wmic.exe, CommandLine containing 'VolumeSerialNumber' and 'Win32_LogicalDisk'. Security Event ID 4688 (if command-line auditing enabled). WMI Activity Event ID 5861 in Microsoft-Windows-WMI-Activity/Operational showing the Win32_LogicalDisk query. Defender MDE: DeviceProcessEvents row with FileName=wmic.exe.

  2. Test 2Hostname and Domain Membership Check via PowerShell WMI

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Win32_ComputerSystem'. PowerShell ScriptBlock Log Event ID 4104 showing the WMI query in clear text. WMI Activity Event ID 5861 for the Win32_ComputerSystem query with property names Name, Domain, DNSDomain.

  3. Test 3File Presence Guardrail Check via CMD

    Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'if exist'. Sysmon Event ID 11: File Create for the %TEMP%\df00tech-guard.cfg file. Security Event ID 4688 showing the full command with conditional logic.

  4. Test 4Security Product Process Check via Tasklist

    Expected signal: Sysmon Event ID 1: Two process creation events — cmd.exe spawning tasklist.exe (CommandLine containing 'IMAGENAME eq ekrn.exe') and findstr.exe. Security Event ID 4688 for tasklist.exe with the /FI IMAGENAME filter argument visible in command-line audit.

  5. Test 5Linux PID File Mutex Guardrail

    Expected signal: Linux auditd SYSCALL records: open()/creat() syscall on /var/run/test_guardrail_df00tech.pid (type=SYSCALL, syscall=open or openat). Syslog entries showing bash process activity. If MDE for Linux is deployed: DeviceFileEvents row with FileName=test_guardrail_df00tech.pid, FolderPath=/var/run/, InitiatingProcessFileName=bash.

Unlock Pro Content

Get the full detection package for T1480 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hub

TA0005Defense Evasion

Sub-techniques (2)

Related Techniques

T1480.001Environmental KeyingT1480.002Mutual ExclusionT1497Virtualization/Sandbox EvasionT1497.001System ChecksT1082System Information DiscoveryT1016System Network Configuration DiscoveryT1057Process DiscoveryT1083File and Directory DiscoveryT1033System Owner/User DiscoveryT1018Remote System Discovery

Same Tactic: Defense Evasion

Popular Detections