Cybergate RAT Mutex Detection
This rule detects the creation of specific mutexes known to be associated with Cybergate RAT activity. The detection is based on a predefined list of mutex names, including '***MUTEX***_SAIR', 'SPY_NET_RATMUTEX', '_x_X_PASSWORDLIST_X_x_', '_x_X_BLOCKMOUSE_X_x_', 'xX_PROXY_SERVER_Xx', and '_x_X_UPDATE_X_x_'. The presence of any of these mutexes indicates potential Cybergate RAT infection or activity on a Windows system.
Sigma
