All Detections

BBTok Loader Mutex Detection

avatar
Achmad Adhikara@adhikara13
updated Feb 27, 2026010

Detects known mutexes associated with BBTok loader activity. The rule specifically looks for the mutex names 'TiiSbtvhvbCMW' and 'KOKKIIKKKOOOO' during process creation events on Windows systems.

Sigma