T1480.001

Execution Guardrails: Environmental Keying

discovered 2026-06-01

Run-once lock file (core/telemetry/.loader.lock) prevents double-execution. Silent exception catch makes the stager inert in clean environments where _runtime.bin is absent.

View on MITRE ATT&CK

Seen in packages

Campaigns