DarkTrack RAT Mutex Detection
This rule detects the creation of specific mutex names associated with the DarkTrack Remote Access Trojan (RAT). The mutex name 'I_AM_DT<uniqueid>' is a known indicator of DarkTrack activity. Detection of this mutex suggests that a DarkTrack RAT may be active on the system, potentially indicating a compromise related to command and control (C2) operations.
Sigma
