Windows Process Creation: Mouse Lock Execution with “Misc314” Indicator
Alerts on Windows executions of Mouse Lock where Company includes “Misc314” and CommandLine contains “Mouse Lock_”.
- Product
- windows
- Category
- process_creation
- Author
- Cian Heasley (SigmaHQ), DRL 1.1
- Published
- 2020-08-13
- Updated
- 2026-07-30
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the process metadata contains the “Mouse Lock” product name and the command line includes the “Mouse Lock_” pattern, along with a “Misc314” company indicator. Attackers may use legitimate tooling repackaged or invoked in automated ways to support credential access and data collection objectives. The detection relies on process-creation telemetry fields for Product, Company, and CommandLine substring matches.
Reporting behind it
- github.comhttps://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf
- sourceforge.nethttps://sourceforge.net/projects/mouselock/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_mouselock_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Mouse Lock Execution with “Misc314” Indicator"
id: 2e2fe3a6-794b-4ac9-a8e9-2686a0ecada4
status: test
description: This rule flags Windows process creation events where the process metadata contains the “Mouse Lock” product name and the command line includes the “Mouse Lock_” pattern, along with a “Misc314” company indicator. Attackers may use legitimate tooling repackaged or invoked in automated ways to support credential access and data collection objectives. The detection relies on process-creation telemetry fields for Product, Company, and CommandLine substring matches.
references:
- https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf
- https://sourceforge.net/projects/mouselock/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_mouselock_execution.yml
author: Cian Heasley, Huntrule Team
date: 2020-08-13
modified: 2023-02-21
tags:
- attack.credential-access
- attack.collection
- attack.t1056.002
logsource:
product: windows
category: process_creation
detection:
selection:
- Product|contains: Mouse Lock
- Company|contains: Misc314
- CommandLine|contains: Mouse Lock_
condition: selection
falsepositives:
- Legitimate uses of Mouse Lock software
level: medium
license: DRL-1.1
related:
- id: c9192ad9-75e5-43eb-8647-82a0a5b493e3
type: derived