PUA - Mouse Lock Execution

Title: PUA - Mouse Lock Execution
Status: test
Description:In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
References:
  -https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf
  -https://sourceforge.net/projects/mouselock/
Author: Cian Heasley
Date: 2020-08-13
modified:2023-02-21
Tags:

• -'attack.credential-access'
• -'attack.collection'
• -'attack.t1056.002'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
Product|contains:'Mouse Lock' Company|contains:'Misc314' CommandLine|contains:'Mouse Lock_'   condition:selection
Falsepositives:
  -Legitimate uses of Mouse Lock software
Level: medium