T1480.001, Environmental Keying, is a form of execution guardrail that uses cryptography. It applies to Linux, macOS and Windows and falls under stealth.
How attackers use it
The payload is delivered encrypted. The decryption key is not shipped with it. Instead, it is derived from values that exist only on the intended target. MITRE lists network shares, physical devices, software versions, files, joined Active Directory domains, system time, and local or external IP addresses.
That has two effects. The adversary does not need to package the key or send it over a monitored network connection. And the payload is hard to analyze elsewhere, because sandboxes, antivirus engines and researchers do not have the right environment to produce the key. MITRE notes this can slow incident response and help adversaries hide their techniques.
MITRE's examples include malware that encrypts components with DPAPI, which ties keys to a user account and machine, and a payload stored in the registry and encrypted with a key built from the drive serial number.
How to detect it
You cannot see the key derivation directly, so look at what surrounds it. MITRE's strategy describes a host that gathers environment details, checks them against what the adversary expects, decrypts a payload, and runs it.
On Windows, that looks like fast discovery through WMI, registry enumeration, share and domain checks, followed by cryptographic operations and then execution. On Linux, native discovery commands, mount point enumeration and cryptographic library use precede execution. On macOS, hardware profiling, network and wireless checks and keychain queries come first.
Clustered discovery followed by decryption and a new process is the pattern.
How to reduce the risk
MITRE recommends not mitigating this one with preventive controls. It may protect unintended targets, and there are no standard attributes from which keys are derived, so a general control is not feasible. Put effort into stopping tools earlier in the chain and detecting follow-on behavior.
Quick check
Why does environmental keying make analysis harder?
The decryption key comes from target specific values, so sandboxes and researchers without that environment cannot recover the payload.
