Suspicious PUA - Mouse Lock Execution (via process_creation)

title: Suspicious PUA - Mouse Lock Execution (via process_creation)
id: e334ce28-907f-5642-b6b3-88c4a58a6dbf
status: stable
description: This rule detects in Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
references:
    - https://attack.mitre.org/techniques/T1056/002/
    - https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf
    - https://sourceforge.net/projects/mouselock/
author: Huntrule Team
date: 2026-03-26
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1056.002
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        - Product|contains: 'Mouse Lock'
        - Company|contains: 'Misc314'
        - CommandLine|contains: 'Mouse Lock_'
    condition: selection
falsepositives:
    - Unknown
level: medium