Techniques › T1480 › T1480.001
T1480.001 Environmental Keying
stealth — Linux, Windows, macOS · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1480.001
0
KEV CVEs mapped here
<p>Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of Execution Guardrails that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.</p><p>Values can be derived from target-specific elements and used to generate a decryption key for an encrypted payload. Target-specific values can be derived from specific network shares, physical devices, software/software versions, files, joined AD domains, system time, and local/external IP addresses. By generating the decryption keys from target-specific environmental values, environmental keying can make sandbox detection, anti-virus detection, crowdsourcing of information, and reverse engineering difficult. These difficulties can slow down the incident response process and help adversaries hide their tactics, techniques, and procedures (TTPs).</p><p>Similar to Obfuscated Files or Information, adversaries may use environmental keying to help protect their TTPs and evade detection. Environmental keying may be used to deliver an encrypted payload to the target that will use target-specific values to decrypt the payload before execution. By utilizing target-specific values to decrypt the payload the adversary can avoid packaging the decryption key with the payload or sending it over a potentially monitored network connection. Depending on the technique for gathering target-specific values, reverse engineering of the encrypted payload can be exceptionally difficult. This can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within.</p><p>Like other Execution Guardrails, environmental keying can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This activity is distinct from typical Virtualization/Sandbox Evasion. While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of environmental keying will involve checking for an expected target-specific value that must match for decryption and subsequent execution to be successful.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0474 Environmental Keying Discovery-to-Decryption Behavioral Chain Detection Strategy v1.0
AN1305 WindowsWindows-specific environmental keying behavioral chain: (1) Rapid system information discovery through multiple techniques (WMI queries, registry enumeration, network share discovery, hostname/domain checks), (2) Target validation through specific environmental artifact collection (AD domain membership, network topology, installed software versions), (3) Cryptographic operation correlation indicating payload decryption based on collected environmental values, (4) Subsequent malicious code execution following successful environmental validation, (5) Temporal clustering of discovery activities suggesting automated environmental assessmentTunable:
DiscoveryTimeWindowCriticalDiscoveryThresholdTargetSpecificArtifactsCryptographicIndicatorPatternsLegitimateAdminAccountsBusinessHoursBaselineWMIQueryComplexityThresholdAN1306 LinuxLinux environmental keying behavioral chain: (1) System information gathering through native commands (uname, hostname, id, whoami, ifconfig/ip) and file system enumeration, (2) Network configuration discovery (route tables, DNS settings, network interfaces), (3) Filesystem and mount point analysis for target-specific directories or devices, (4) Process and service enumeration to identify target-specific software, (5) Cryptographic library usage correlation with collected environmental data, (6) Payload execution following successful environmental validationauditd:SYSCALLexecve syscalls for discovery commands (uname, hostname, id, whoami, ps, netstat, mount) with command-line parameter analysis→ DC0064 Command Executionlinux:syslogkernel messages related to cryptographic operations, module loading, and filesystem access patterns→ DC0055 File AccessTunable:DiscoveryCommandSequenceThresholdProcessAncestryDepthCryptographicLibraryIndicatorsTargetSpecificFilesystemsAuthorizedDiscoveryUsersNetworkConfigurationBaselineContainerContextIdentifiersAN1307 macOSmacOS environmental keying behavioral chain: (1) System information discovery through native utilities (system_profiler, sw_vers, hostname, dscl) and Security framework queries, (2) Hardware and software enumeration including serial numbers, installed applications, and system versions, (3) Network configuration assessment (networksetup, scutil) and wireless network discovery, (4) Keychain and security context validation, (5) Unified Logs correlation with cryptographic framework usage (CommonCrypto, Security.framework), (6) Application bundle execution following environmental validationmacos:unifiedlogprocess execution events for discovery utilities (system_profiler, sw_vers, dscl, networksetup) with command-line parameter analysis→ DC0032 Process Creationmacos:unifiedlogSecurity framework operations including keychain access, cryptographic operations, and certificate validation→ DC0064 Command Executionfs:fseventsfile system events indicating access to system configuration files and environmental information sources→ DC0055 File AccessTunable:SystemProfilerDataTypesSecurityFrameworkOperationPatternsUnifiedLogRetentionWindowApplicationBundleValidationPathsNetworkConfigurationIdentifiersMacOSVersionBaselineFSEventsFilteringCriteria
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1480.001
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.