LoFP / powershell developer may used this function in their script for instance checking too.

Techniques

• T1027
• T1027.005
• T1059.001

Sample rules

Powershell Creating Thread Mutex

• source: splunk
• technicques:
  • T1027
  • T1027.005
  • T1059.001

Description

The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the mutex function. This function is commonly seen in some obfuscated PowerShell scripts to make sure that only one instance of there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.

Detection logic

`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" 
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
| rename Computer as dest 
|rename UserID as user 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `powershell_creating_thread_mutex_filter`