T1480.001
Execution Guardrails: Environmental Keying
discovered 2026-06-01Run-once lock file (core/telemetry/.loader.lock) prevents double-execution. Silent exception catch makes the stager inert in clean environments where _runtime.bin is absent.
View on MITRE ATT&CK