PowerShell Script Creating Thread Mutex

This analytic detects PowerShell scripts that create thread mutexes, identified by the presence of "Threading.Mutex" in PowerShell Script Block Logging (EventCode 4104). This technique is often used by malware to ensure only a single instance of a malicious script runs on a compromised system, which can indicate sophisticated malware or persistence mechanisms. Such activity could allow an attacker to maintain exclusive control over a process, potentially leading to further exploitation or persistence within the environment.