# T1480 - Execution Guardrails

## SOC Recommendation
Investigate Execution Guardrails activity in the context of Stealth: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
let create_policy_ignore_time_window = 10m;
let query_frequency = 1h;
let dlp_policy_events = PowerPlatformAdminActivity
    | where TimeGenerated >= ago(query_frequency)
    | where EventOriginalType == "GovernanceApiPolicyOperation"
    | where PropertyCollection has_any ("DeleteDlpPolicy", "UpdateDlpPolicy", "CreateDlpPolicy")
    | mv-expand PropertyCollection
    | extend
        Name = tostring(PropertyCollection.Name),
        Value = tostring(PropertyCollection.Value)
    | summarize Properties = make_bag(bag_pack(Name, Value))
        by
        TimeGenerated,
        EventOriginalUid
    | extend
        PolicyName = tostring(Properties['powerplatform.analytics.resource.display_name']),
        EventType = tostring(Properties['powerplatform.analytics.resource.tenant.governance.api_policy.operation_name']),
        ActorName = tostring(Properties['enduser.principal_name']),
        PolicyId = tostring(Properties['powerplatform.analytics.resource.id']),
        AdditionalInfo = Properties['powerplatform.analytics.resource.tenant.governance.api_policy.additional_resources'];
let delete_events = dlp_policy_events
    | where EventType == "DeleteDlpPolicy";
let update_events = dlp_policy_events
    | where EventType == "UpdateDlpPolicy";
let create_events = dlp_policy_events
    | where EventType == "CreateDlpPolicy"
    | extend ignore_time = TimeGenerated + create_policy_ignore_time_window;
union
    delete_events,
    (update_events
    | join kind=leftouter (
        create_events
        | project-away TimeGenerated
        )
        on PolicyId
    | where isempty(ignore_time) or TimeGenerated > ignore_time
    | project-away ignore_time)
| where TimeGenerated >= ago(query_frequency)
| extend
    AccountName = tostring(split(ActorName, "@")[0]),
    UPNSuffix = tostring(split(ActorName, "@")[1])
| project
    TimeGenerated,
    ActorName,
    EventType,
    PolicyName,
    PolicyId,
    AccountName,
    UPNSuffix,
    AdditionalInfo
```

## Escalation Criteria
- Execution Guardrails activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.