Rhadamanthys Stealer Mutex Detection
The rule detects the creation of processes that utilize specific mutex names associated with the Rhadamanthys stealer. Specifically, it looks for the mutex name 'Global\MSCTF.Asm.{digits}', where '{digits}' represents a variable sequence of numbers. This mutex pattern is a known indicator of Rhadamanthys stealer activity, suggesting the presence of this malware on the system.
Sigma
