Adversary-created named mutex using system APIs (e.g., CreateMutexW) followed by conditional process termination or alternate code path indicating malware avoiding reinfection.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| File Creation (DC0039) | WinEventLog:Sysmon | EventCode=11 |
| Field | Description |
|---|---|
| mutex_name_entropy_threshold | Filter out common benign mutex names; highlight suspicious high-entropy/dynamic names. |
| parent_process_path | Limit alerting to non-standard parent-child relationships indicative of malware staging or self-spawning. |
| TimeWindow | Correlate mutex creation + rapid process exit or lack of further activity within a short timeframe. |
File lock acquired via open() + flock() or lockf() on predictable path (e.g., /tmp/.lock123) followed by conditional early exit or divergent process behavior.
| Data Component | Name | Channel |
|---|---|---|
| File Access (DC0055) | auditd:SYSCALL | open, flock, fcntl, unlink |
| Process Termination (DC0033) | auditd:SYSCALL | exit_group |
| Field | Description |
|---|---|
| lockfile_path_regex | Detect patterns like /tmp/.lock*, /var/run/*lock used by malware. |
| exit_code | Track specific exit codes (e.g., 1, 2) that signal lock acquisition failure. |
| TimeWindow | Correlate lockfile access + early process termination within N seconds. |
User-mode application uses flock() or NSDistributedLock to gain exclusive access to a resource file (e.g., /tmp/guard.lock), conditional logic alters execution if already locked.
| Data Component | Name | Channel |
|---|---|---|
| OS API Execution (DC0021) | macos:unifiedlog | flock|NSDistributedLock|FileHandle.*lockForWriting |
| Process Termination (DC0033) | macos:unifiedlog | process.*exit.*code |
| Field | Description |
|---|---|
| lockfile_path | Path to mutex file (e.g., /tmp/*, /private/tmp/*), tune per environment. |
| user_context | Flag non-user processes using these APIs. |
| TimeWindow | Detection correlation across short time intervals between lock attempt and process exit. |