Blackmoon Botnet Mutex Detection
This rule detects the creation of specific mutex names ('kongxin1123') which are known to be associated with the Blackmoon botnet. The detection is based on monitoring process creation events on Windows systems for these particular mutexes, indicating potential Blackmoon botnet activity.
Sigma
