Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1480_execution-guardrails
Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
Passed 19 of 23 test cases with the skill, and 11 of 23 without it.
and 8 more in the full report
8 fixed11 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our threat intelligence feed indicates an adversary using environmental validation checks—such as verifying joined domain names and user-agent strings—to restrict payload execution to designated targets. Please generate a defensive audit document covering manual evaluation checks across endpoint OSs, recommended remediation approach, and risk rating for this defensive evasion technique.
| Checked | Without skill | With skill |
|---|---|---|
| Recommends M1055 Do Not Mitigate for execution guardrail checks. | Missed | Passed |
| Includes ESXi along with Linux, macOS, and Windows in the OS manual checks. | Missed | Passed |
| Assigns High severity to the risk finding for execution guardrails. | Passed | Passed |
The instructions your model reads when the skill loads.
Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign. Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.
Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical Virtualization/Sandbox Evasion. While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.
Adversaries may identify and block certain user-agents to evade defenses and narrow the scope of their attack to victims and platforms on which it will be most effective. A user-agent self-identifies data such as a user's software application, operating system, vendor, and version. Adversaries may check user-agents for operating system identification and then only serve malware for the exploitable software while ignoring all other operating systems.
Platforms: ESXi, Linux, macOS, Windows
Identify Attack Surface: Determine if the target environment is susceptible to Execution Guardrails by examining the target platforms (ESXi, Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1480 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 11 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.