So I have "Practical Malware Analysis" by Sikorski and Honig in front of me. They describe the use of threading, but I think the more popular form of what you're describing is a mutex. Malware can create mutexes with specific names, then look to see if that mutex is owned by another process.

They also describe the use of the registry. Malware can look for specific values in the registry, and achieve persistence by embedding itself as a service.

So yes, this technique is used. I believe some of the sample "malware" they ship with the book uses these techniques.

So I have "Practical Malware Analysis" by Sikorski and Honig in front of me. They describe the use of threading, but I think the more popular form of what you're describing is a mutex. Malware can create mutexes at the kernel level with specific names using the KeInitializeMutex system call, and use that mutex to mark that system. If another piece of the same malware drops on the system it can then look to see if that named mutex is a) present, or b) owned by another process. If it is, then it is reasonable to assume that you've already infected the computer. Of course, it becomes a great signature for anti-virus and other pieces of competing malware.

They also describe the use of the registry. Malware can look for specific values in the registry, and achieve persistence by embedding itself as a service.

So yes, this technique is used. I believe some of the sample "malware" they ship with the book uses these techniques.