windows enabled community high v1.0.0

cl-mutexverifiers

Proxy execution with CL_Mutexverifiers.ps1 Located at: C:\Windows\diagnostics\system\WindowsUpdate\CL_Mutexverifiers.ps1; C:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1; C:\Windows\diagnostics\system\WindowsUpdate\CL_Mutexverifiers.ps1.

📋 Live Preview 
cl-mutexverifiers
cl-mutexverifiers

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Import the PowerShell Diagnostic CL_Mutexverifiers script and call runAfterCancelProcess to launch an executable. (Proxy execution)

. C:\Windows\diagnostics\system\AERO\CL_Mutexverifiers.ps1   \nrunAfterCancelProcess {PATH:.ps1}

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_cl_mutexverifiers.yml

Documentation

cl-mutexverifiers

cl-mutexverifiers is a Windows LOLBin. Proxy execution with CL_Mutexverifiers.ps1 Located at: C:\Windows\diagnostics\system\WindowsUpdate\CL_Mutexverifiers.ps1; C:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1; C:\Windows\diagnostics\system\WindowsUpdate\CL_Mutexverifiers.ps1.

References