| ID | Name |
|---|---|
| T1480.001 | Environmental Keying |
| T1480.002 | Mutual Exclusion |
Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.[1]
While local mutexes only exist within a given process, allowing multiple threads to synchronize access to a resource, system mutexes can be used to synchronize the activities of multiple processes.[1] By creating a unique system mutex associated with a particular malware, adversaries can verify whether or not a system has already been compromised.[2]
In Linux environments, malware may instead attempt to acquire a lock on a mutex file. If the malware is able to acquire the lock, it continues to execute; if it fails, it exits to avoid creating a second instance of itself.[3][4]
Mutex names may be hard-coded or dynamically generated using a predictable algorithm.[5]
| ID | Name | Description |
|---|---|---|
| G0082 | APT38 | |
| S1070 | Black Basta |
Black Basta will check for the presence of a hard-coded mutex |
| S1161 | BPFDoor |
When executed, BPFDoor attempts to create and lock a runtime file, |
| S1236 | CLAIMLOADER |
CLAIMLOADER has created hardcoded mutex to ensure only a single instance of the malware is running.[8][9] |
| S1247 | Embargo |
Embargo has utilized a hardcoded mutex name of "LoadUpOnGunsBringYourFriends" using the |
| S0168 | Gazer |
Gazer creates a mutex using the hard-coded value |
| S0632 | GrimAgent |
GrimAgent uses the last 64 bytes of the binary to compute a mutex name. If the generated name is invalid, it will default to the generic |
| S1202 | LockBit 3.0 |
LockBit 3.0 can create and check for a mutex containing a hash of the |
| S0013 | PlugX |
PlugX has leveraged a mutex in its infection process.[15][16] |
| S0012 | PoisonIvy |
PoisonIvy creates a mutex using either a custom or default value.[17] |
| S1242 | Qilin |
Qilin can create a mutex to insure only one instance is running.[18] |
| S0496 | REvil |
REvil attempts to create a mutex using a hard-coded value to ensure that no other instances of itself are running on the host.[19] |
| S1183 | StrelaStealer |
StrelaStealer variants include the use of mutex values based on the victim system name to prevent reinfection.[20] |
| S0562 | SUNSPOT |
SUNSPOT creates a mutex using the hard-coded value |
| S1239 | TONESHELL |
TONESHELL has created a mutex to avoid duplicate execution.[9] |
| S1196 | Troll Stealer |
Troll Stealer creates a mutex during installation to prevent duplicate execution.[22] |
| ID | Mitigation | Description |
|---|---|---|
| M1055 | Do Not Mitigate |
Execution Guardrails likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised. If targeted, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0132 | Detection of Mutex-Based Execution Guardrails Across Platforms | AN0372 |
Adversary-created named mutex using system APIs (e.g., CreateMutexW) followed by conditional process termination or alternate code path indicating malware avoiding reinfection. |
| AN0373 |
File lock acquired via open() + flock() or lockf() on predictable path (e.g., /tmp/.lock123) followed by conditional early exit or divergent process behavior. |
||
| AN0374 |
User-mode application uses flock() or NSDistributedLock to gain exclusive access to a resource file (e.g., /tmp/guard.lock), conditional logic alters execution if already locked. |