OVALProject/Sandbox — Issue #15: add support for a test to check mutexes on windows
Author: djhaynes
Created: 2012-03-05 14:50:36+00:00
State: open

Malware on windows frequently create windows mutex objects. As such, it is often a sign of system compromise if a known bad mutex is detected on an end system. See documentation on windows mutexes here:

http://msdn.microsoft.com/en-us/library/ms684266%28v=vs.85%29.aspx

Reference a google search for "malware windows mutex" to see numerous examples of how malware uses this capability in windows.

It looks like this test can be implemented as a general windows object directory test.

Please see the following oval-developer-list post for more information.

http://making-security-measurable.1364806.n2.nabble.com/windows-mutex-test-Proposal-td6228170.html