Xeno RAT Mutex Detection
This rule detects the creation of specific mutexes associated with the Xeno RAT malware. It looks for mutex names starting with 'xeno_rat_nd' followed by five alphanumeric characters, optionally ending with '-admin'. The detection is based on the `MutexName` field within process creation logs.
Sigma
