Claimloader Mutex Detection

Achmad Adhikara@adhikara13

•updated Feb 27, 2026•0•14

This rule detects the creation of specific mutex names associated with Claimloader malware activity. The mutex names observed include patterns like 'TB<yearmonthdate>', 'MTM<yearmonthdate>', 'CATM<yearmonthdate>', and fixed strings such as 'GameBoxABC', 'GameGpu0428', 'GameFind057', and 'GameBoxTV59'. Detection relies on monitoring process creation events for these specific mutex names, indicating potential Claimloader execution or presence on a Windows system.