GRIMPULL Loader Mutex Detection
This rule detects the creation of processes that utilize specific mutex names associated with the GRIMPULL loader. The detection is based on the presence of the mutex name 'aff391c406ebc4c3' during process creation events on Windows systems. The rule aims to identify potential GRIMPULL loader activity by monitoring for these known indicators.
Sigma
