What it does. 'Analyzes ransomware kill switch mechanisms, including mutex-based execution Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-ransomware-kill-switch-detection, or copy the skill folder into ~/.claude/skills/implementing-ransomware-kill-switch-detection/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ransomware-kill-switch-detection/SKILL.md

SKILL.md (verbatim)

name: implementing-ransomware-kill-switch-detection
description: 'Analyzes ransomware kill switch mechanisms, including mutex-based execution
  guards, domain-based kill switches (e.g. WannaCry-style), and registry termination
  checks, then implements mutex vaccination and kill switch domain monitoring to stop
  ransomware before it runs. Use when analyzing a sample''s execution guards or deploying
  vaccination/monitoring as a defensive control.

  '
domain: cybersecurity
subdomain: ransomware-defense
tags:
- ransomware
- kill-switch
- mutex
- detection
- WannaCry
- malware-analysis
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- PR.DS-11
- RS.MA-01
- RC.RP-01
- PR.IR-01
mitre_attack:
- T1078
- T1190
- T1059
- T1486
- T1490
mitre_f3:
  version: '1.1'
  tactics:
  - positioning
  - monetization
  techniques:
  - id: T1219
    name: Remote Access Tools
    tactic: positioning
    source: attack
  - id: F1018
    name: Convert to Cryptocurrency
    tactic: monetization
    source: f3
  - id: F1017
    name: Conversion to Physical Monetary Instruments
    tactic: monetization
    source: f3
  - id: F1047
    name: Transfer of funds
    tactic: monetization
    source: f3

Implementing Ransomware Kill Switch Detection

When to Use

• Analyzing a ransomware sample to determine if it contains a kill switch mechanism (mutex, domain, registry)
• Deploying proactive mutex vaccination across endpoints to prevent known ransomware families from executing
• Monitoring DNS for kill switch domain lookups that indicate ransomware attempting to check before encrypting
• During incident response to quickly determine if a ransomware variant can be stopped by activating its kill switch
• Building detection signatures for ransomware mutex creation events using Sysmon or EDR telemetry

Do not use kill switch vaccination as a primary defense. Not all ransomware families implement kill switches, and those that do may remove them in newer versions. This is a supplementary detection and prevention layer.

Prerequisites

• Python 3.8+ with ctypes (Windows) for mutex creation and enumeration
• Sysmon installed with Event ID 1 (process creation) and Event ID 17/18 (pipe/mutex events) configured
• Access to malware analysis sandbox for identifying kill switch mechanisms in samples
• DNS monitoring capability for detecting kill switch domain resolution attempts
• Familiarity with Windows internals: mutexes (mutants), kernel objects, named pipes
• Reference database of known ransomware mutexes (github.com/albertzsigovits/malware-mutex)

Workflow

Step 1: Identify Kill Switch Mechanisms in Ransomware

Analyze samples for common kill switch patterns:

Kill Switch Types Found in Ransomware:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. MUTEX-BASED (most common):
   - Ransomware creates a named mutex at startup
   - If mutex already exists → another instance is running → exit
   - Defense: Pre-create the mutex to prevent execution
   - Examples:
     WannaCry:     Global\MsWinZonesCacheCounterMutexA
     Conti:        kasKDJSAFJauisiudUASIIQWUA82
     REvil:        Global\{GUID-based-on-machine}
     Ryuk:         Global\YOURPRODUCT_MUTEX

2. DOMAIN-BASED:
   - Ransomware resolves a hardcoded domain before executing
   - If domain resolves → security sandbox detected → exit
   - Defense: Register/sinkhole the domain to activate kill switch
   - Examples:
     WannaCry v1:  iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
     WannaCry v1:  fferfsodp9ifjaposdfjhgosurijfaewrwergwea.com

3. REGISTRY-BASED:
   - Check for specific registry key/value before executing
   - If key exists → exit (anti-analysis or kill switch)
   - Defense: Create the registry key proactively

4. FILE-BASED:
   - Check for existence of specific file or directory
   - If marker file exists → exit
   - Defense: Create the marker file on all endpoints

5. LANGUAGE-BASED:
   - Check system language/keyboard layout
   - Exit if Russian/CIS country keyboard detected
   - Common in Eastern European ransomware groups

Step 2: Deploy Mutex Vaccination

Pre-create known ransomware mutexes on endpoints to prevent execution:

# Windows mutex vaccination using ctypes
import ctypes
from ctypes import wintypes

kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)

def create_mutex(name):
    """Create a named mutex to vaccinate against ransomware."""
    handle = kernel32.CreateMutexW(None, False, name)
    error = ctypes.get_last_error()
    if handle == 0:
        return False, f"Failed to create mutex: error {error}"
    if error == 183:  # ERROR_ALREADY_EXISTS
        return True, f"Mutex already exists (already vaccinated): {name}"
    return True, f"Mutex created successfully: {name}"

KNOWN_RANSOMWARE_MUTEXES = [
    "Global\\MsWinZonesCacheCounterMutexA",        # WannaCry
    "Global\\kasKDJSAFJauisiudUASIIQWUA82",        # Conti
    "Global\\YOURPRODUCT_MUTEX",                     # Ryuk variant
    "Global\\JhbGjhBsSQjz",                         # Maze
    "Global\\sdjfhksjdhfsd",                         # Generic ransomware
]

Step 3: Monitor for Mutex Creation Events

Use Sysmon to detect when ransomware creates its characteristic mutexes:

<!-- Sysmon configuration for mutex monitoring -->
<Sysmon schemaversion="4.90">
  <EventFiltering>
    <!-- Event ID 1: Process creation with mutex indicators -->
    <ProcessCreate onmatch="include">
      <CommandLine condition="contains">mutex</CommandLine>
      <CommandLine condition="contains">CreateMutex</CommandLine>
    </ProcessCreate>
  </EventFiltering>
</Sysmon>

Detection via Event Logs:
━━━━━━━━━━━━━━━━━━━━━━━━
Windows Security Log:
  Event ID 4688: Process creation (enable command line logging)

Sysmon:
  Event ID 1:  Process create (includes command line and hashes)
  Event ID 17: Pipe created (named pipes, similar to mutexes)

PowerShell detection:
  Event ID 4104: Script block logging (detect mutex creation in scripts)

Velociraptor artifact:
  Windows.Detection.Mutants - Enumerates all named mutant objects

Step 4: Monitor DNS for Kill Switch Domains

Detect ransomware domain-based kill switch resolution attempts:

DNS Monitoring for Kill Switch Domains:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Monitor DNS queries for known kill switch domains
2. High-entropy domain names (>4.0 entropy in domain label) may indicate
   ransomware kill switch domains or DGA-generated C2 domains
3. Queries to newly registered domains from endpoints that typically
   only access well-established domains

Indicators:
  - Domain with no prior resolution history
  - Domain registered in last 24-72 hours
  - High character entropy in domain name
  - Resolution attempt followed by either mass encryption (kill switch failed)
    or process termination (kill switch activated)

Step 5: Enumerate Active Mutexes for Incident Response

During an active incident, scan endpoints for ransomware-associated mutexes:

# PowerShell: List all named mutant objects using Sysinternals Handle
# handle.exe -a -p <PID> | findstr "Mutant"

# Velociraptor query for mutex hunting:
# SELECT * FROM glob(globs="\\BaseNamedObjects\\*") WHERE Name =~ "mutex_pattern"

# Python-based enumeration (requires pywin32):
# import win32event
# handle = win32event.OpenMutex(0x00100000, False, "Global\\MutexName")

Verification

• Verify mutex vaccination by attempting to create the same mutex (should get ERROR_ALREADY_EXISTS)
• Test that vaccinated mutexes survive system reboot (they do not; re-apply at startup via scheduled task)
• Confirm DNS monitoring detects test queries for known kill switch domains
• Validate Sysmon event generation for mutex creation by running a test script
• Check that vaccination does not interfere with legitimate applications using similar mutex names
• Test against actual ransomware samples in an isolated sandbox to confirm kill switch activation

Key Concepts

Tools & Systems

• Sysmon: Microsoft system monitor providing Event ID 17/18 for named pipe and mutex creation monitoring
• Velociraptor: Endpoint visibility tool with built-in artifacts for enumerating mutant (mutex) objects on Windows
• Sysinternals Handle: Command-line tool for listing open handles including named mutexes per process
• malware-mutex (GitHub): Community-maintained database of mutexes used by known malware families
• ANY.RUN: Interactive malware sandbox that reports mutex creation during dynamic analysis
• PassiveDNS: DNS monitoring infrastructure for detecting kill switch domain resolution attempts

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

API Reference: Ransomware Kill Switch Detection

Windows Mutex (Mutant) APIs

CreateMutex (kernel32.dll)

HANDLE CreateMutexW(
  LPSECURITY_ATTRIBUTES lpMutexAttributes,  // NULL for default
  BOOL bInitialOwner,                       // TRUE to own immediately
  LPCWSTR lpName                            // Named mutex string
);
// Returns: Handle to mutex, or NULL on failure
// GetLastError() == ERROR_ALREADY_EXISTS (183) if mutex already exists

OpenMutex (kernel32.dll)

HANDLE OpenMutexW(
  DWORD dwDesiredAccess,  // SYNCHRONIZE (0x00100000)
  BOOL bInheritHandle,    // FALSE
  LPCWSTR lpName          // Named mutex string
);
// Returns: Handle if exists, NULL if not found

PowerShell Mutex Operations

# Create a named mutex
$created = $false
$m = New-Object System.Threading.Mutex($true, "Global\MutexName", [ref]$created)

# Check if mutex exists
try {
  $m = [System.Threading.Mutex]::OpenExisting("Global\MutexName")
  "EXISTS"
} catch { "NOT_FOUND" }

Known Ransomware Kill Switch Mutexes

Known Kill Switch Domains

Sysmon Configuration for Mutex Detection

Event ID 1 - Process Creation

<Sysmon schemaversion="4.90">
  <EventFiltering>
    <ProcessCreate onmatch="include">
      <Image condition="excludes">C:\Windows\</Image>
    </ProcessCreate>
  </EventFiltering>
</Sysmon>

Velociraptor Mutex Hunting

Windows.Detection.Mutants Artifact

SELECT * FROM glob(globs="\\BaseNamedObjects\\*")
WHERE Name =~ "MsWinZonesCacheCounterMutexA|kasKDJSAF|YOURPRODUCT"

Sysinternals Handle Tool

handle.exe -a | findstr /i "Mutant"
handle.exe -a -p <PID> | findstr /i "Mutant"

DNS Kill Switch Monitoring

Python DNS Resolution Check

import socket

def check_domain(domain):
    try:
        ip = socket.gethostbyname(domain)
        return {"resolves": True, "ip": ip}
    except socket.gaierror:
        return {"resolves": False}

Passive DNS Services

Malware Mutex Database

albertzsigovits/malware-mutex (GitHub)

URL: https://github.com/albertzsigovits/malware-mutex
Format: JSON with mutex name, malware family, source reference

ANY.RUN Mutex Search

URL: https://any.run/cybersecurity-blog/mutex-search-in-ti-lookup/
Search: Threat Intelligence Lookup → Synchronization → Mutex name

Mutex Vaccination Deployment Methods

GPO Startup Script Path

Computer Configuration → Policies → Windows Settings →
Scripts (Startup/Shutdown) → Startup → Add Script

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.