D3F@ck Loader Mutex Detection
This rule detects the creation of specific mutexes, 'Little further', which are known to be associated with the D3F@ck loader. The detection is based on monitoring process creation events on Windows systems for these particular mutex names. The rule aims to identify the presence and activity of the D3F@ck loader by flagging these unique mutexes.
Sigma
