Windows Process Creation: Mouse Lock Execution with “Misc314” Indicator

Alerts on Windows executions of Mouse Lock where Company includes “Misc314” and CommandLine contains “Mouse Lock_”.

FreeUnreviewedSigmamediumv1

windows-process-creation-mouse-lock-execution-with-misc314-indicator-c9192ad9

title: "Windows Process Creation: Mouse Lock Execution with “Misc314” Indicator"
id: 2e2fe3a6-794b-4ac9-a8e9-2686a0ecada4
status: test
description: This rule flags Windows process creation events where the process metadata contains the “Mouse Lock” product name and the command line includes the “Mouse Lock_” pattern, along with a “Misc314” company indicator. Attackers may use legitimate tooling repackaged or invoked in automated ways to support credential access and data collection objectives. The detection relies on process-creation telemetry fields for Product, Company, and CommandLine substring matches.
references:
  - https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf
  - https://sourceforge.net/projects/mouselock/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_mouselock_execution.yml
author: Cian Heasley, Huntrule Team
date: 2020-08-13
modified: 2023-02-21
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1056.002
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - Product|contains: Mouse Lock
    - Company|contains: Misc314
    - CommandLine|contains: Mouse Lock_
  condition: selection
falsepositives:
  - Legitimate uses of Mouse Lock software
level: medium
license: DRL-1.1
related:
  - id: c9192ad9-75e5-43eb-8647-82a0a5b493e3
    type: derived

What it detects

This rule flags Windows process creation events where the process metadata contains the “Mouse Lock” product name and the command line includes the “Mouse Lock_” pattern, along with a “Misc314” company indicator. Attackers may use legitimate tooling repackaged or invoked in automated ways to support credential access and data collection objectives. The detection relies on process-creation telemetry fields for Product, Company, and CommandLine substring matches.

Known false positives

Legitimate uses of Mouse Lock software

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.