Techniques › T1480.002 › AN0374
AN0374 Analytic 0374
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>User-mode application uses flock() or NSDistributedLock to gain exclusive access to a resource file (e.g., /tmp/guard.lock), conditional logic alters execution if already locked.</p>
- Detects
- T1480.002 Mutual Exclusion
- Part of
- DET0132 Detection of Mutex-Based Execution Guardrails Across Platforms
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | flock|NSDistributedLock|FileHandle.*lockForWriting | DC0021 OS API Execution |
| macos:unifiedlog | process.*exit.*code | DC0033 Process Termination |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
lockfile_path | Path to mutex file (e.g., /tmp/*, /private/tmp/*), tune per environment. |
user_context | Flag non-user processes using these APIs. |
TimeWindow | Detection correlation across short time intervals between lock attempt and process exit. |