| ID | Name |
|---|---|
| T1480.001 | Environmental Keying |
| T1480.002 | Mutual Exclusion |
Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.[1]
While local mutexes only exist within a given process, allowing multiple threads to synchronize access to a resource, system mutexes can be used to synchronize the activities of multiple processes.[1] By creating a unique system mutex associated with a particular malware, adversaries can verify whether or not a system has already been compromised.[2]
In Linux environments, malware may instead attempt to acquire a lock on a mutex file. If the malware is able to acquire the lock, it continues to execute; if it fails, it exits to avoid creating a second instance of itself.[3][4]
Mutex names may be hard-coded or dynamically generated using a predictable algorithm.[5]
| ID | Name | Description |
|---|---|---|
| G0082 | APT38 | |
| S1070 | Black Basta |
Black Basta will check for the presence of a hard-coded mutex |
| S1161 | BPFDoor |
When executed, BPFDoor attempts to create and lock a runtime file, |
| S1236 | CLAIMLOADER |
CLAIMLOADER has created hardcoded mutex to ensure only a single instance of the malware is running.[8][9] |
| S1247 | Embargo |
Embargo has utilized a hardcoded mutex name of "LoadUpOnGunsBringYourFriends" using the |
| S0168 | Gazer |
Gazer creates a mutex using the hard-coded value |
| S0632 | GrimAgent |
GrimAgent uses the last 64 bytes of the binary to compute a mutex name. If the generated name is invalid, it will default to the generic |
| S9023 | HiddenFace |
HiddenFace can create a mutex to ensure only one instance is running at a time.[14] |
| G0094 | Kimsuky |
Kimsuky has utilized a mutex to detect whether its malware is actively running on the victim host.[15][16] Kimsuky has leveraged PowerShell to store the Process ID (PID) of the currently running malicious PowerShell script into a file named pid.txt which is saved locally on the victim host in the %TEMP% Directory and is queried prior to execution of subsequent PowerShell script to prevent duplication.[16] |
| S1202 | LockBit 3.0 |
LockBit 3.0 can create and check for a mutex containing a hash of the |
| S0013 | PlugX |
PlugX has leveraged a mutex in its infection process.[18][19] |
| S0012 | PoisonIvy |
PoisonIvy creates a mutex using either a custom or default value.[20] |
| S9019 | PureCrypter |
PureCrypter code contains a global mutex.[21] |
| S1242 | Qilin |
Qilin can create a mutex to ensure only one instance is running.[22] |
| S0496 | REvil |
REvil attempts to create a mutex using a hard-coded value to ensure that no other instances of itself are running on the host.[23] |
| S9024 | SPAWNCHIMERA |
SPAWNCHIMERA has fixed a buffer overflow vulnerability (CVE-2025-0282) by hooking the strncpy function and limiting the size to 256 to prevent other actors from leveraging the exploit.[24] SPAWNCHIMERA has converted its process name to hexadecimal and verifies an added value which is triggered when the first byte of the source copied to the fixed strncpy function matches |
| S1183 | StrelaStealer |
StrelaStealer variants include the use of mutex values based on the victim system name to prevent reinfection.[25] |
| S0562 | SUNSPOT |
SUNSPOT creates a mutex using the hard-coded value |
| S1239 | TONESHELL |
TONESHELL has created a mutex to avoid duplicate execution.[9] |
| S1196 | Troll Stealer |
Troll Stealer creates a mutex during installation to prevent duplicate execution.[27] |
| ID | Mitigation | Description |
|---|---|---|
| M1055 | Do Not Mitigate |
Execution Guardrails likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised. If targeted, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0132 | Detection of Mutex-Based Execution Guardrails Across Platforms | AN0372 |
Adversary-created named mutex using system APIs (e.g., CreateMutexW) followed by conditional process termination or alternate code path indicating malware avoiding reinfection. |
| AN0373 |
File lock acquired via open() + flock() or lockf() on predictable path (e.g., /tmp/.lock123) followed by conditional early exit or divergent process behavior. |
||
| AN0374 |
User-mode application uses flock() or NSDistributedLock to gain exclusive access to a resource file (e.g., /tmp/guard.lock), conditional logic alters execution if already locked. |