Dark Crystal RAT Mutex Detection
This rule detects the creation of specific mutexes known to be associated with Dark Crystal RAT (Remote Access Trojan) activity. The rule looks for two distinct mutex names: 'DCR_MUTEX-<20_random_alphanumeric_characters>' and 'DcRatMutex_qwqdanchun'. The presence of these mutexes indicates a high likelihood of Dark Crystal RAT infection or execution on a Windows system.
Sigma
