REMCOS RAT Mutex Detection
This rule detects the creation of specific mutexes known to be associated with the REMCOS Remote Access Trojan (RAT). The rule looks for several distinct mutex names, including 'MARE_IS_BEAUTIFUL_EX', 'Rmc-<uniqueid>', 'Remcos_Mutex_Inj', 'remcos_<uniqueid>', 'Remcos-<uniqueid>', and 'Mutex_RemWatchdog'. The presence of any of these mutexes indicates potential REMCOS RAT activity on a Windows system.
Sigma
