MITRE ATT&CK technique · stealth

`T1480.002` Mutual Exclusion

Sub-technique of T1480 Execution Guardrails

Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.(Citation: Microsoft Mutexes) While local mutexes only exist within a given process, allowing multiple threads to synchronize access to a resource, system…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Qilin

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.