DarkComet RAT Mutex Detection
This rule detects the creation of specific mutex names known to be associated with the DarkComet Remote Access Trojan (RAT). The mutex names include patterns like 'DC_MUTEX-<7 Alphanumeric Characters>', 'DCMIN_MUTEX-<7 Alphanumeric Characters>', and exact strings 'DCMUTEX' and 'DCPERSFWBP'. The detection is based on process creation events where these mutex names are observed.
Sigma
