Techniques › T1480 › T1480.002
T1480.002 Mutual Exclusion
stealth — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1480.002
0
KEV CVEs mapped here
<p>Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.</p><p>While local mutexes only exist within a given process, allowing multiple threads to synchronize access to a resource, system mutexes can be used to synchronize the activities of multiple processes. By creating a unique system mutex associated with a particular malware, adversaries can verify whether or not a system has already been compromised.</p><p>In Linux environments, malware may instead attempt to acquire a lock on a mutex file. If the malware is able to acquire the lock, it continues to execute; if it fails, it exits to avoid creating a second instance of itself.</p><p>Mutex names may be hard-coded or dynamically generated using a predictable algorithm.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0132 Detection of Mutex-Based Execution Guardrails Across Platforms v1.0
AN0372 WindowsAdversary-created named mutex using system APIs (e.g., CreateMutexW) followed by conditional process termination or alternate code path indicating malware avoiding reinfection.Tunable:
mutex_name_entropy_thresholdparent_process_pathTimeWindowAN0373 LinuxFile lock acquired via open() + flock() or lockf() on predictable path (e.g., /tmp/.lock123) followed by conditional early exit or divergent process behavior.Tunable:lockfile_path_regexexit_codeTimeWindowAN0374 macOSUser-mode application uses flock() or NSDistributedLock to gain exclusive access to a resource file (e.g., /tmp/guard.lock), conditional logic alters execution if already locked.Tunable:lockfile_pathuser_contextTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1480.002
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.