T1480.001 — Environmental Keying

Tactic: Stealth · Platforms: Linux, Windows, macOS

Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are…

Sub-technique of Execution Guardrails (T1480).

Sigma detection rules (3)

title: "T1480.001 Execution Guardrails: Environmental Keying"
id: f581a4ba-0c57-44f1-a27b-e7895df03436
description: 'Detects a single process invocation whose command line both queries environment-specific hardware/OS identifiers and performs cryptographic key derivation or decryption operations, indicative of Environmental Keying malware. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: DiscoveryTimeWindow, CriticalDiscoveryThreshold, TargetSpecificArtifacts, CryptographicIndicatorPatterns, LegitimateAdminAccounts, BusinessHoursBaseline.'
references:
  - https://attack.mitre.org/techniques/T1480/001
author: Shahrukh Khan
date: 2026-03-07
license: MIT
tags:
  - attack.stealth
  - attack.t1480.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_env_query:
    CommandLine|contains:
      - 'Win32_ComputerSystem'
      - 'Win32_BIOS'
      - 'Win32_DiskDrive'
      - 'Win32_Processor'
      - 'MachineGuid'

  selection_crypto_derive:
    CommandLine|contains:
      - 'FromBase64String'
      - 'CreateDecryptor'
      - 'AesCryptoServiceProvider'
      - 'Rijndael'
      - 'System.Security.Cryptography'
      - 'ConvertTo-SecureString'

  condition: selection_env_query and selection_crypto_derive

falsepositives:
  - Legitimate licensing/DRM validation tools or credential-vault agents may occasionally combine hardware-fingerprint queries with cryptographic calls in one script.

level: high

title: "T1480.001 Execution Guardrails: Environmental Keying"
id: dd84f96d-b8d9-4fad-84fb-162631ad0657
description: 'Environmental Keying Discovery-to-Decryption Behavioral Chain Detection Strategy. The prior version promised a discovery-to-decryption behavioral chain in its tuning fields but the actual detection logic only fired on plain hardware-discovery commands (lscpu, dmidecode, lspci), which is generic System Information Discovery (T1082) and captures no decryption/keying behavior at all. This version requires the discovery command and a decrypt/keygen operation (openssl enc -d, gpg --decrypt) to occur within the same shell -c invocation, approximating the discovery-then-decrypt chain that environmental keying actually describes (deriving a decryption key from target-specific values, then using it to decrypt a payload) rather than flagging bare hardware inventory. Tune using: DiscoveryCommandSequenceThreshold, CryptographicLibraryIndicators, AuthorizedDiscoveryUsers.'
references:
  - https://attack.mitre.org/techniques/T1480/001
author: Shahrukh Khan
date: 2026-04-20
license: MIT
tags:
  - attack.stealth
  - attack.t1480.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_shell:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
    a1: '-c'
  selection_discovery:
    a2|contains:
      - 'lscpu'
      - 'dmidecode'
      - 'lspci'
  selection_decrypt:
    a2|contains:
      - 'openssl enc -d'
      - 'gpg --decrypt'
      - 'gpg -d'

  condition: selection_shell and selection_discovery and selection_decrypt

falsepositives:
  - Legitimate provisioning/config-management scripts that both inventory hardware and separately decrypt secrets within the same session, though co-occurrence in a single shell -c invocation specifically is uncommon outside this pattern; System Information Discovery alone (without a decrypt step) is intentionally excluded and should be reviewed under a T1082 rule instead.

level: medium

title: "T1480.001 Execution Guardrails: Environmental Keying"
id: dbf46bcc-64b1-4b10-a15f-69b15bf4d4c2
description: 'Environmental Keying Discovery-to-Decryption Behavioral Chain Detection Strategy. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SystemProfilerDataTypes, SecurityFrameworkOperationPatterns, UnifiedLogRetentionWindow, ApplicationBundleValidationPaths, NetworkConfigurationIdentifiers, MacOSVersionBaseline.'
references:
  - https://attack.mitre.org/techniques/T1480/001
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.stealth
  - attack.t1480.001

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/system_profiler'
      - '/networksetup'
      - '/scutil'
  selection_args:
    CommandLine|contains:
      - 'SPNetworkDataType'
      - '--get'
      - 'getcomputername'
  condition: selection and selection_args

falsepositives:
  - Environmental keying checks that gate malware execution on domain name, IP range, or hardware UUID look identical to benign asset inventory scripts run by MDM and helpdesk tooling, so unified log alone cannot separate malicious guardrail logic from routine inventory collection.

level: informational

Related sub-techniques

• T1480.002 Mutual Exclusion

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1480.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan