Home/ MITRE Matrix/ Defense Evasion/ T1480

T1480Execution Guardrails

T1480 — Execution Guardrails is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 3 detection use cases covering it and 4 threat-intel articles citing it.

Defense Evasion

View on the matrix → Filter Detection Library MITRE official spec ↗

3Use cases

4Articles

2Sub-techniques

1Tactic

Sub-techniques (2)

T1480.001 · Environmental Keying T1480.002 · Mutual Exclusion

Use cases covering this technique (3)

Linux Auditd AI CLI Permission Override Activated ESCU actions · hunting P [LLM] vm2 NodeVM denylist bypass PoC strings — getBuiltinModule + inspector/promises Bespoke exploit · alerting DSΣPDDCS [LLM] TamperedChef trojanized-app activation via --cm / --enableupdate / --fullupdate flags Bespoke install · alerting DSΣPDDCS

Articles citing this technique (4)

crit [GHSA / CRITICAL] CVE-2026-47140: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution art-173

crit Tracking TamperedChef Clusters via Certificate and Code Reuse art-237

crit Sednit reloaded: Back in the trenches art-477

crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-642