3LOSH RAT Mutex Detection

Achmad Adhikara@adhikara13

•updated Feb 27, 2026•0•11

This rule detects the creation of specific mutexes known to be associated with 3LOSH RAT activity. Specifically, it looks for the mutex named 'AsyncMutex_Devil'.