trailofbits / osquery-extensions

osquery extensions by Trail of Bits

Home Page:https://blog.trailofbits.com/2017/12/14/announcing-the-trail-of-bits-osquery-extension-repository/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

mutex registration

dguido opened this issue · comments

Provide osquery a list of Windows mutexes and have it register them to block other processes with the same mutex from executing.

https://net.cs.uni-bonn.de/fileadmin/user_upload/wichmann/Infection_Markers_as_Vaccine_against_Malware.pdf

@dguido thanks for linking this. This is an interesting approach.

Addressed in #27