CastleRAT Mutex Detection
This rule detects the presence of specific mutex names associated with CastleRAT malware activity. The detection is based on a predefined list of unique mutex strings that CastleRAT is known to use for process synchronization or to indicate its presence on a system. The rule triggers if any of these mutex names are observed, indicating a high likelihood of CastleRAT infection.
Sigma
