Most malware tries to run everywhere it lands. Some does the opposite. T1480, Execution Guardrails, covers payloads that check for conditions expected on the intended target and run only if those conditions match. MITRE files it under stealth, and it applies to ESXi, Linux, macOS and Windows.
How attackers use it
The adversary supplies values about the target environment and the payload checks for them. MITRE lists examples such as specific network share names, attached physical devices, files, joined Active Directory domains, and local or external IP addresses.
The purpose is to keep capabilities from being exposed in places the adversary does not intend to operate. That reduces collateral damage and keeps tooling away from researchers.
MITRE draws a clear line from sandbox evasion. Sandbox evasion checks for known sandbox values and continues only if there is no match. A guardrail checks for an expected target value and continues only if there is a match.
The page also covers user-agent filtering. An adversary may check the user-agent string to identify the operating system, then serve malware only to the exploitable software and ignore everything else.
MITRE's procedure examples show the idea in plain terms. One ransomware variant fails to run if the target VMFS path does not exist. One piece of malware terminates itself when certain execution flags are missing. One campaign used geolocation filtering to send traffic from non-target regions to legitimate sites.
How to detect it
The guardrail itself is just conditional logic, so detection focuses on the environment checks that come before it. MITRE's detection strategy describes a chain: discovery, a decision based on the results, then execution or exit.
- Windows: rapid reconnaissance through WMI, registry and network share enumeration, collection of host, domain, IP and software identifiers, and timing that links discovery to later execution or network activity.
- Linux: intensive enumeration with common system commands, review of file paths and network configuration, process and user enumeration, and external IP checks to confirm location.
- macOS: system and hardware profiling, network enumeration for location checks, application inventories, and checks of security feature status.
- ESXi: enumeration of virtual machines and configurations with hypervisor command line tools, datastore reconnaissance, and checks of vCenter connectivity.
Clustered discovery activity in a short window is the common thread, and it suggests automation.
How to reduce the risk
MITRE's guidance here is unusual: do not mitigate it with preventive controls. A guardrail can protect unintended targets from being compromised, so blocking it directly is not the right lever.
If you are the intended target, focus on two things instead. Stop adversary tools from running earlier in the chain of activity, and identify the malicious behavior that follows if a payload does run.
That points to good coverage of initial access, solid endpoint telemetry, and detection of the discovery burst described above.
Quick check
How do guardrails differ from sandbox evasion?
Sandbox evasion continues only if no known sandbox value matches. A guardrail continues only if an expected target specific value does match.
What does MITRE recommend instead of preventive controls?
Prevent adversary tools from running earlier in the chain and identify subsequent malicious behavior if a system is compromised.
