Persian RAT Mutex Detection
This rule detects the creation of processes that utilize specific mutex names associated with Persian RAT activity. The detection is based on the presence of the string 'Persian' within the MutexName field during process creation events on Windows systems. This indicates potential command and control (C2) communication or other malicious operations by the Persian RAT.
Sigma
