Techniques › T1480 › AN1551
AN1551 Analytic 1551
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Windows environmental validation behavioral chain: (1) Rapid system discovery reconnaissance through WMI queries, registry enumeration, and network share discovery, (2) Environment-specific artifact collection (hostname, domain, IP addresses, installed software, hardware identifiers), (3) Cryptographic operations or conditional logic based on collected environmental values, (4) Selective payload execution contingent on environmental validation results, (5) Temporal correlation between discovery activities and subsequent execution or network communication</p>
- Detects
- T1480 Execution Guardrails
- Part of
- DET0562 Multi-Platform Execution Guardrails Environmental Validation Detection Strategy
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| WinEventLog:Security | EventCode=4648 | DC0002 User Account Authentication |
| WinEventLog:Security | EventCode=4624, 4648 | DC0067 Logon Session Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=8 | DC0020 Process Modification |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=13, 14 | DC0063 Windows Registry Key Modification |
| WinEventLog:WMI | EventCode=5857, 5858, 5860, 5861 | DC0008 WMI Creation |
| WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
DiscoveryTimeWindow | Maximum time window for correlating multiple discovery activities indicating reconnaissance phase - adjust based on normal system behavior (default: 300 seconds) |
DiscoveryActivityThreshold | Minimum number of different discovery techniques within time window to trigger detection - balance between false positives and coverage (default: 4 activities) |
CryptographicLibraryWhitelist | Approved cryptographic libraries and modules for legitimate organizational use - maintain based on approved software inventory |
WMIQueryComplexityThreshold | Complexity score for WMI queries indicating reconnaissance vs. legitimate administration - tune based on administrative patterns |
EnvironmentalArtifactList | Environment-specific values commonly targeted by guardrails (hostnames, domains, network shares) - customize for organizational environment |
ExecutionDelayBaseline | Statistical baseline for normal delay between discovery and execution activities - establish through historical analysis |