执行保护

Anchor can terminate itself if specific execution flags are not present.^[1]

Apostle's ransomware variant requires that a base64-encoded argument is passed when executed, that is used as the Public Key for subsequent encryption operations. If Apostle is executed without this argument, it automatically runs a self-delete function.^[2]

BitPaymer compares file names and paths to a list of excluded names and directory names during encryption.^[3]

BoomBox can check its current working directory and for the presence of a specific file and terminate if specific values are not found.^[4]

BPFDoor creates a zero byte PID file at /var/run/haldrund.pid. BPFDoor uses this file to determine if it is already running on a system to ensure only one instance is executing at a time.^[5]

CHIMNEYSWEEP can execute a task which leads to execution if it finds a process name containing "creensaver."^[6]

DarkGate uses per-victim links for hosting malicious archives, such as ZIP files, in services such as SharePoint to prevent other entities from retrieving them.^[7]

DEADEYE can ensure it executes only on intended systems by identifying the victim's volume serial number, hostname, and/or DNS domain.^[8]

EnvyScout can call window.location.pathname to ensure that embedded files are being executed from the C: drive, and will terminate if they are not.^[4]

Gamaredon Group has used geoblocking to limit downloads of the malicious file to specific geographic locations.^[9]

LunarLoader can use the DNS domain name of a compromised host to create a decryption key to ensure a malicious payload can only execute against the intended targets.^[10]

NativeZone can check for the presence of KM.EkeyAlmaz1C.dll and will halt execution unless it is in the same directory as the rest of the malware's components.^[4][11]

Raspberry Robin will check for the presence of several security products on victim machines and will avoid UAC bypass mechanisms if they are identified.^[12] Raspberry Robin can use specific cookie values in HTTP requests to command and control infrastructure to validate that requests for second stage payloads originate from the initial downloader script.^[13]

ROADSWEEP requires four command line arguments to execute correctly, otherwise it will produce a message box and halt execution.^[6][14][15]

Small Sieve can only execute correctly if the word Platypus is passed to it on the command line.^[16]

Stuxnet checks for specific operating systems on 32-bit machines, Registry keys, and dates for vulnerabilities, and will exit execution if the values are not met.^[17]

SUNSPOT only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.^[18]

Torisma is only delivered to a compromised host if the victim's IP address is on an allow-list.^[19]

VaporRage has the ability to check for the presence of a specific DLL and terminate if it is not found.^[4]

Execution Guardrails likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised. If targeted, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised.