PUA - Mouse Lock Execution

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Cian Heasley
Source: github.com/SigmaHQ/sigma

In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.

Known false positives

Legitimate uses of Mouse Lock software

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1056.002` Input Capture: GUI Input Capture
Collection	`T1056.002` Input Capture: GUI Input Capture

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: PUA - Mouse Lock Execution
id: c9192ad9-75e5-43eb-8647-82a0a5b493e3
status: test
description: In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
references:
    - https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf
    - https://sourceforge.net/projects/mouselock/
author: Cian Heasley
date: 2020-08-13
modified: 2023-02-21
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1056.002
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        - Product|contains: 'Mouse Lock'
        - Company|contains: 'Misc314'
        - CommandLine|contains: 'Mouse Lock_'
    condition: selection
falsepositives:
    - Legitimate uses of Mouse Lock software
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Product|contains: 'Mouse Lock'
    - Company|contains: 'Misc314'
    - CommandLine|contains: 'Mouse Lock_'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`Mouse Lock_`	`field:"CommandLine" kind:match value:"Mouse Lock_"`
`Company`	match	`Misc314`	`field:"Company" kind:match value:"Misc314"`
`Product`	match	`Mouse Lock`	`field:"Product" kind:match value:"Mouse Lock"`