heroui logo

Powershell Creating Thread Mutex

Splunk Security Content

View Source
Summary
This detection rule monitors for the execution of PowerShell scripts that implement a mutex function, specifically targeting Event Code 4104 from PowerShell Script Block Logging. The use of mutexes is a common tactic among malicious actors, as it helps prevent multiple instances of a script from running concurrently. By analyzing the script blocks that contain the `Threading.Mutex` class, the detection aims to identify potentially obfuscated PowerShell scripts which may signify sophisticated malware or persistence mechanisms on the system. Confirmed malicious use of this function could allow attackers to gain exclusive control over processes, facilitating ongoing exploitation and persistence.
Categories
  • Endpoint
Data Sources
  • Pod
  • Application Log
ATT&CK Techniques
  • T1027
  • T1027.005
  • T1059.001
Created: 2024-11-13