SpiceRAT Mutex Detection
This rule detects the creation of specific mutexes known to be associated with SpiceRAT malware activity. The detection is based on two distinct mutex names: '{00866F68-6C46-4ABD-A8D6-2246FE482F99}' and '{00861111-3333-4ABD-GGGG-2246FE482F99}'. The rule monitors process creation events on Windows systems for the presence of these mutex names.
Sigma
