BazarLoader Mutex Detection
This rule detects the presence of specific mutex names that are known to be associated with BazarLoader malware activity. The rule looks for two distinct mutex names: '{b837ef4f-10ee-4821-ac76-2331eb32a23f}' and '{0caa6ebb-cf78-4b01-9b0b-51032c9120ce}'. The detection is triggered when a process creates or attempts to create a mutex with either of these names. This activity is indicative of BazarLoader execution on a Windows system.
Sigma
