CastleLoader Mutex Detection

Achmad Adhikara@adhikara13

•updated Feb 27, 2026•0•10

Detects known mutexes associated with CastleLoader activity. The rule specifically looks for the mutex name '10KCnWHtIoABhkL2Cl3u' during process creation events.