Skip to content

mutex.md

Latest commit

 

History

History
30 lines (21 loc) · 801 Bytes

mutex.md

File metadata and controls

30 lines (21 loc) · 801 Bytes
Raw

mutex

Schema ID: https://github.com/NextronSystems/jsonlog/thorlog/v3/windows-mutex | JSON Schema: https://json-schema.org/draft/2020-12/schema | Definition: WindowsMutex

Fields

Field names are shown in UPPERCASE as used in Sigma rules. The lowercase JSON name is shown in parentheses for reference.

Sigma Field JSON Name Type Required Description Example Values
MUTEX mutex string ✅
TYPE type string ✅

No nested fields in this type.

Sigma Rule Template

logsource:
    product: THOR
    service: "mutex"

detection:
    selection:
        MUTEX|contains: 'suspicious_string'
    condition: selection

level: medium