Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1480.002_mutual-exclusion
Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.
Passed 22 of 25 test cases with the skill, and 14 of 25 without it.
and 7 more in the full report
8 fixed14 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
When performing an initial assessment of T1480.002, what is the first step in the verification checklist before checking platform-specific indicators?
| Checked | Without skill | With skill |
|---|---|---|
| Directs identifying if the Mutual Exclusion technique is applicable to the target environment. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1480
Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.
While local mutexes only exist within a given process, allowing multiple threads to synchronize access to a resource, system mutexes can be used to synchronize the activities of multiple processes. By creating a unique system mutex associated with a particular malware, adversaries can verify whether or not a system has already been compromised.
In Linux environments, malware may instead attempt to acquire a lock on a mutex file. If the malware is able to acquire the lock, it continues to execute; if it fails, it exits to avoid creating a second instance of itself.
Mutex names may be hard-coded or dynamically generated using a predictable algorithm.
Platforms: Linux, macOS, Windows
Identify Attack Surface: Determine if the target environment is susceptible to Mutual Exclusion by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1480.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 14 / 25 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.