Gamarue Backdoor Mutex Detection
This rule detects the creation of processes that utilize specific mutex names associated with the Gamarue backdoor. The detection is based on a direct match of the 'MutexName' field against a predefined list of known Gamarue mutexes. The rule aims to identify potential Gamarue backdoor activity on Windows systems by monitoring process creation events for these unique mutex identifiers.
Sigma
