T1480.002, Mutual Exclusion, is an execution guardrail where malware checks whether it is already running on a host. It applies to Linux, macOS and Windows and is filed under stealth.
How attackers use it
A mutex is a locking mechanism that lets only one thread or process hold a resource at a time. System mutexes can coordinate across processes. By creating a unique system mutex tied to a specific piece of malware, an adversary can check whether a system is already compromised.
On Linux, malware may try to lock a mutex file instead. If it gets the lock, it continues. If not, it exits so it does not create a second instance. Mutex names can be hard coded or generated with a predictable algorithm.
MITRE lists several examples. One backdoor tries to lock a runtime file under /var/run and exits if it cannot, and several families use a hard coded mutex created with CreateMutexW.
How to detect it
MITRE describes three analytics.
- Named mutex: a named mutex created through a system API such as CreateMutexW, especially when the process then terminates or takes a different path.
- File lock: a lock taken on a predictable file path with flock or lockf, especially when the process exits early.
- User mode lock: an application that uses flock or NSDistributedLock on a resource file and changes behavior if the lock is already held.
Because names may be hard coded, a known mutex name from a malware report can double as an indicator when you hunt.
How to reduce the risk
MITRE advises against preventive controls here. Focus on stopping adversary tools earlier in the chain and on identifying subsequent malicious behavior.
Quick check
What does Linux malware do instead of a system mutex?
It tries to lock a mutex file. If the lock succeeds it runs, and if it fails it exits.
