{"id":"T1480.002","name":"Mutual Exclusion","url":"https://attack.mitre.org/techniques/T1480/002","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0132","stix_id":"x-mitre-detection-strategy--d22f1848-fc32-4fdb-999b-9c0845fb6552","name":"Detection of Mutex-Based Execution Guardrails Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0132","analytics":[{"id":"AN0372","stix_id":"x-mitre-analytic--1282f497-ce04-4151-9bd0-4eedbf4530b6","name":"Analytic 0372","description":"Adversary-created named mutex using system APIs (e.g., CreateMutexW) followed by conditional process termination or alternate code path indicating malware avoiding reinfection.","url":"https://attack.mitre.org/detectionstrategies/DET0132#AN0372","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"mutex_name_entropy_threshold","description":"Filter out common benign mutex names; highlight suspicious high-entropy/dynamic names."},{"field":"parent_process_path","description":"Limit alerting to non-standard parent-child relationships indicative of malware staging or self-spawning."},{"field":"TimeWindow","description":"Correlate mutex creation + rapid process exit or lack of further activity within a short timeframe."}],"live":true,"detection_strategies":["DET0132"],"techniques":["T1480.002"]},{"id":"AN0373","stix_id":"x-mitre-analytic--7c0e4ffa-7f95-41de-9e3b-de2ad4a7a9ae","name":"Analytic 0373","description":"File lock acquired via open() + flock() or lockf() on predictable path (e.g., /tmp/.lock123) followed by conditional early exit or divergent process behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0132#AN0373","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open, flock, fcntl, unlink","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"exit_group","data_component":"DC0033","data_component_name":"Process Termination","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"lockfile_path_regex","description":"Detect patterns like /tmp/.lock*, /var/run/*lock used by malware."},{"field":"exit_code","description":"Track specific exit codes (e.g., 1, 2) that signal lock acquisition failure."},{"field":"TimeWindow","description":"Correlate lockfile access + early process termination within N seconds."}],"live":true,"detection_strategies":["DET0132"],"techniques":["T1480.002"]},{"id":"AN0374","stix_id":"x-mitre-analytic--4ab12b3f-5c6a-42a6-8d9c-c10b7e814986","name":"Analytic 0374","description":"User-mode application uses flock() or NSDistributedLock to gain exclusive access to a resource file (e.g., /tmp/guard.lock), conditional logic alters execution if already locked.","url":"https://attack.mitre.org/detectionstrategies/DET0132#AN0374","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"flock|NSDistributedLock|FileHandle.*lockForWriting","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"process.*exit.*code","data_component":"DC0033","data_component_name":"Process Termination","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"lockfile_path","description":"Path to mutex file (e.g., /tmp/*, /private/tmp/*), tune per environment."},{"field":"user_context","description":"Flag non-user processes using these APIs."},{"field":"TimeWindow","description":"Detection correlation across short time intervals between lock attempt and process exit."}],"live":true,"detection_strategies":["DET0132"],"techniques":["T1480.002"]}],"live":true,"version":"1.0","techniques":["T1480.002"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}