Tonto Team Loader Mutex Detection
The rule detects the creation of specific mutexes known to be associated with the Tonto Team loader malware. It looks for two distinct mutex names: '{A931568B-94AF-449D-B7F6-6585EF9E9839}' and 'QuitMutex<pid>'. The detection is based on process creation events where these mutex names are observed. This activity is indicative of the Tonto Team loader executing on a system.
Sigma
