Mutual Exclusion
Subtechnique · ATTACK:enterprise:T1480.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1480.002",
"title": "Mutual Exclusion",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1480/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--49fca0d2-685d-41eb-8bd4-05451cc3a742",
"external_id": "T1480.002",
"domain": "enterprise",
"created": "2024-09-19T14:00:03.401Z",
"modified": "2026-05-12T15:12:00.630Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "Intezer RedXOR 2021",
"url": "https://intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/"
},
{
"source_name": "Sans Mutexes 2012",
"url": "https://www.sans.org/blog/looking-at-mutex-objects-for-malware-discovery-indicators-of-compromise/"
},
{
"source_name": "ICS Mutexes 2015",
"url": "https://isc.sans.edu/diary/How+Malware+Generates+Mutex+Names+to+Evade+Detection/19429/"
},
{
"source_name": "Microsoft Mutexes",
"url": "https://learn.microsoft.com/en-us/dotnet/standard/threading/mutexes"
},
{
"source_name": "Deep Instinct BPFDoor 2023",
"url": "https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game"
}
]
}Explicit source assertions (22)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1247 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0cc89d3e-9fe9-42f1-acb5-a7bce55840c0
Cyble Embargo Ransomware May 2024 · ESET Embargo Ransomware October 2024ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--158e6f8e-cd86-4945-b962-14d60000bf60
Halcyon Qilin.B OCT 2024ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1633e6bb-fe82-48a5-8c0b-26d0a06b357a
Zscaler PureCrypter JUN 2022ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19ac2479-ffef-40dc-9dbb-02c11ba49908
Deep Instinct BPFDoor 2023ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e66dafa-3cf0-4f21-85e0-a9fa9827aaa1
Eset PlugX Korplug Mustang Panda March 2022 · Sophos Mustang Panda PLUGXATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2602353f-7337-4fee-8dd4-dee77cb6bbd0
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40ae395e-5d26-444a-848e-f4d8a171a592
ESET HiddenFace 2024ATTACK:enterprise:M1055 → mitigates → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ea008a7-d193-4ec6-b60b-68b4fec16690
ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f145407-cd6b-4e96-957f-a74cd6c84c52
Group IB GrimAgent July 2021ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--715faca6-f933-45b5-bb56-45cedf9dd18c
SecureWorks September 2019ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b82ddb8-6a3a-4f0a-b463-7b20a9199647
FireEye Poison IvyATTACK:enterprise:S1236 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e76bec6-f5f8-497a-9c17-33b3b5d1765e
IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDAATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b8222e0-7184-4d26-a5df-b797298d0c6d
S2W Troll Stealer 2024ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9cb9a1a6-8fdf-4201-af7d-156a92d0f358
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2d22aa1-685a-484b-a164-27850c5bbaa0
2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDAATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db52b791-ad42-45e5-b3be-5386c0d819f2
Fortgale StrelaStealer 2023ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dba52e3c-fb05-4001-9fa4-39d4cd673ad0
Gen Digital Kimsuky HTTPTroy October 2025 · Aryaka Kimsuky July 2025ATTACK:enterprise:S0168 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec581cdf-0339-4f54-b88c-df4acfc25c12
ESET Gazer Aug 2017ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1d3a631-cbde-40d0-86c1-496a6814df38
1 - appvATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f537f279-f1e2-4171-b6bb-b02ad620b207
Deep Instinct Black Basta August 2022ATTACK:enterprise:T1480.002 → subtechnique-of → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc0fdebd-df94-4e56-a7d8-5f40dc7a777d
ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd429e36-81b7-4e3d-a537-e27c0c6258d1
JPCERT SPAWNCHIMERA Ivanti February 2025