1200KM / sigma-rule
PUA - Mouse Lock Execution — Sigma Rule
Sigma rule c9192ad9-75e5-43eb-8647-82a0a5b493e3. PUA - Mouse Lock Execution — Sigma Rule. In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
Rule metadata and linked tags
Author: Cian Heasley. Source status: test; severity: medium. Source dates: 2020-08-13 / 2023-02-21.
{
"product": "windows",
"category": "process_creation"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: ae2032244329bd08767c242e91ef364cfc7ec284c9481c31b953e5d93f587299
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: PUA - Mouse Lock Execution
id: c9192ad9-75e5-43eb-8647-82a0a5b493e3
status: test
description: In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
references:
- https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf
- https://sourceforge.net/projects/mouselock/
author: Cian Heasley
date: 2020-08-13
modified: 2023-02-21
tags:
- attack.credential-access
- attack.collection
- attack.t1056.002
logsource:
product: windows
category: process_creation
detection:
selection:
- Product|contains: 'Mouse Lock'
- Company|contains: 'Misc314'
- CommandLine|contains: 'Mouse Lock_'
condition: selection
falsepositives:
- Legitimate uses of Mouse Lock software
level: medium
False positives
- Legitimate uses of Mouse Lock software
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.