Borat RAT Mutex Detection
This rule detects the creation of processes that utilize specific mutex names associated with the Borat Remote Access Trojan (RAT). The detection is triggered when a process creates a mutex named 'boratratmutex_sa8xofh1budx'. This mutex name is a known indicator of compromise for the Borat RAT, suggesting active malware presence or execution on the system. The rule leverages process creation logs to identify these mutexes.
Sigma
