Hayabusa medium test sigma

PUA - Mouse Lock Execution

In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 1,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": [
    {
      "Product
| contains": "Mouse Lock"
    },
    {
      "Company
| contains": "Misc314"
    },
    {
      "CommandLine
| contains": "Mouse Lock_"
    }
  ],
  "condition": "process_creation and selection"
}

False Positives

  • ⚠ Legitimate uses of Mouse Lock software

Field Validations

Loading…

Comments (0)

Loading comments...