CLRLoad Loader Mutex Detection
This rule detects the creation of processes that utilize specific mutex names ('Wo0r0KGWhYGO') known to be associated with the CLRLoad loader malware. The detection is based on monitoring process creation events on Windows systems and checking for the presence of these unique mutex names. The primary goal is to identify potential CLRLoad loader activity, which is often linked to initial execution and malware loading.
Sigma
