Skip to content

Execution Guardrails

Technique · ATTACK:enterprise:T1480

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1480",
  "title": "Execution Guardrails",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1480",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--853c4192-4311-43e1-bfbb-b11b14911852",
  "external_id": "T1480",
  "domain": "enterprise",
  "created": "2019-01-31T02:10:08.261Z",
  "modified": "2026-05-12T15:12:00.685Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "FireEye Outlook Dec 2019",
      "url": "https://www.fireeye.com/blog/threat-research/2019/12/breaking-the-rules-tough-outlook-for-home-page-attacks.html"
    },
    {
      "source_name": "Trellix-Qakbot",
      "url": "https://www.trellix.com/blogs/research/qakbot-evolves-to-onenote-malware-distribution/"
    },
    {
      "source_name": "FireEye Kevin Mandia Guardrails",
      "url": "https://www.cyberscoop.com/kevin-mandia-fireeye-u-s-malware-nice/"
    }
  ]
}

Explicit source assertions (55)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03cb8f9a-7ad7-4aa8-966f-bf768023eb89

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--044701e4-2c5c-4574-8ac7-1d9034dff4d6

Cyfirma_Vidar_June2024

ATTACK:enterprise:S1179 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0747ca0c-ff34-4364-bb17-765054d06533

Microsoft BlackByte 2023

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--089cfcb7-2e3b-43f2-8e63-5e42fcbdcf06

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bd24ac6-08f1-441b-bb55-777e20799b17

Trend Micro Mustang Panda Earth Preta Toneshell February 2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e7e92e6-2163-44cb-b8c5-420577aeada7

SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1546211f-fc4f-416a-9e79-43310b09bc51

Group-IB RansomHub FEB 2025

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19f69da1-f2c1-4228-867b-e0d07a123681

Socket GlassWorm January 2026

ATTACK:enterprise:S0504 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a1e8bdb-bcb5-41ec-a151-c2f5ebc90ab2

Cyberreason Anchor December 2019

ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cc1c2b0-5fb8-420e-8285-db4616a9fab2

Crowdstrike Indrik November 2018

ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d2b2827-7289-487a-9ea5-b1245ea7448a

Sandfly BPFDoor 2022

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1eafa58c-6247-4a4f-ba06-39e39f4da806

Trellix Darkgate 2023

ATTACK:enterprise:M1055 → mitigates → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20cc9dc5-61ad-4fbb-86da-4861e60b98e4

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23b1bbb5-ab75-42f7-8bc9-d1c918f6817d

TrendMicro RaspberryRobin 2022 · HP RaspberryRobin 2024

ATTACK:enterprise:S0636 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25e7301f-2207-4d02-aa69-772c222dab70

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:S0634 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27fd8291-3fba-49e9-a2e0-d3a76a584471

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:S1185 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--299f512d-5afc-44b0-b4c1-9cda96306166

Huntress LightSpy macOS 2024

ATTACK:enterprise:S0678 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37599333-0974-4442-976e-6f8d8c3ceac7

McAfee Lazarus Nov 2020

ATTACK:enterprise:S1035 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3790f831-7228-4de1-9272-3d304dd7328c

NCSC GCHQ Small Sieve Jan 2022

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38640ec4-060f-47ea-8ea5-58e42f5e8341

Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024

ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a749db3-cabf-4849-a9e4-a7ba21bfbd1f

Breakdev Evilginx 2.4 SEP 2020

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ba83641-d086-4a15-8465-33d8caa98c6a

Kaspersky LODEINFO Part II OCT 2022

ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--472d44d4-2297-4a39-b719-c5e044926726

Recorded Future RedDelta 2025

ATTACK:enterprise:S9039 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cee562b-14d6-45b3-8409-7009be02cb82

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53ae49f4-6cc4-4fb0-b79e-84af1aa136eb

Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · Sentinel Labs LockBit 3.0 JUL 2022

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c39581b-cf62-4b14-bce2-9efbcf46440b

Picus Qilin MAR 2025 · Trend Micro Agenda Ransomware OCT 2025

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69e823be-ab39-44c1-b56f-b371a2a0118b

SophosGnGal_SystemBC_Dec2020 · HarmonProofpoint_SystemBC_Aug2019

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a92b1de-a2f2-4e68-aabc-a5568614f18c

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70d81631-4f33-4fd0-98ac-15b57b8c1ed1

CrowdStrike SUNSPOT Implant January 2021

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72654ee9-cf29-49a0-b53c-87de0d9e868d

Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:S1133 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7313a6d7-fb8f-4254-8de2-fd42da02dd6a

SentinelOne Agrius 2021

ATTACK:enterprise:S1143 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79a92839-53b3-4ff2-90f4-8f9630b2da93

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7dd9023d-73df-4fb3-a8b3-0e44564d3b92

Aikido CanisterWorm MAR 2026

ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8801b2f6-2f8d-4e75-aecf-6432695c969f

Zscaler PureCrypter JUN 2022

ATTACK:enterprise:S0635 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ece1131-5221-498b-9370-30b3b459203e

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:S9026 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90a3bf9a-3edd-4a86-ab53-6fda02c6d375

Trend Micro Earth Kasha Updates APR 2025

ATTACK:enterprise:S1200 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99174f3b-8c31-4d4d-b803-0a6bff16e859

Cybereason StealBit Exfiltration Tool

ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abff6712-78bf-4a73-a950-0547442ff301

Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad02f6c8-9b1c-4d94-b6fd-fb953b9f8048

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6455e96-9b28-4749-8b76-220f27ac4ee8

ESET RedLine Stealer November 2024 · Proofpoint RedLine Stealer March 2020

ATTACK:enterprise:S0637 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b704b2b0-50c5-4fba-ab6c-db346b3524c7

MSTIC Nobelium Toolset May 2021 · SentinelOne NobleBaron June 2021

ATTACK:enterprise:S1150 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c29450bf-20a4-47f8-8ef9-7c6559cfad75

CISA Iran Albanian Attacks September 2022 · Mandiant ROADSWEEP August 2022 · Microsoft Albanian Government Attacks September 2022

ATTACK:enterprise:S1180 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbad7487-ad0d-4165-9fd2-3c3121021457

Trustwave BlackByte 2021

ATTACK:enterprise:T1480.001 → subtechnique-of → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2468213-1073-43d0-bd10-020b23597a6f

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d579ce62-ba0b-4637-9237-d5dc92c32922

Socket HexEval BeaverTail Contagious Interview June 2025

ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dacadb45-10fd-4f34-b6fe-f63047a3346e

Splunk ShrinkLocker 2024

ATTACK:enterprise:S1210 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc35293c-815c-467e-bdd4-8ee0e5fdd644

Cisco LotusBlossom 2025

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc906a37-e2f5-4e8f-8f3c-317ad667d484

Picus BlackByte 2022 · Cisco BlackByte 2024

ATTACK:enterprise:S1184 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2a0910e-16a9-493e-8c0e-d5557e77e3b0

Google Cloud BOLDMOVE 2023

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9d29d73-6a2e-4b06-81e0-4dd29467711b

Hunt.io TeamPCP Toolkit MAY 2026 · Wiz Mini Shai-Hulud MAY 2026 · Phoenix TeamPCP 20 MAY 2026

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2da1e7c-d5c2-4f1b-b58a-3650c758858a

Aqua Security Blog Trivy Compromise APR 2026 · Wiz TeamPCP KICS MAR 2026

ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f45b0144-2b01-4e99-aff5-538cab3670d0

Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f523a64f-7c27-4c23-a35d-c56b4bcce8be

unit42_gamaredon_dec2022 · VenereCiscoTalos_Gamaredon_Mar2025

ATTACK:enterprise:T1480.002 → subtechnique-of → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc0fdebd-df94-4e56-a7d8-5f40dc7a777d

ATTACK:enterprise:S1194 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd4c608f-ebfc-4c17-947d-f79e854b4bb1

Cisco Akira Ransomware OCT 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.