Mutual Exclusion

Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.¹ While local mutexes only exist within a given process, allowing multiple threads to synchronize access to a resource, system mutexes can be used to synchronize the activities of multiple processes.² By creating a unique system mutex associated with a particular malware, adversaries can verify whether or not a system has already been compromised.³ In Linux environments, malware may instead attempt to acquire a lock on a mutex file. If the malware is able to acquire the lock, it continues to execute; if it fails, it exits to avoid creating a second instance of itself.⁴⁵ Mutex names may be hard-coded or dynamically generated using a predictable algorithm.⁶

1. Microsoft Mutexes
2. Microsoft Mutexes
3. Sans Mutexes 2012
4. Intezer RedXOR 2021
5. Deep Instinct BPFDoor 2023
6. ICS Mutexes 2015

使用该技术的组织

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。