XieBroRAT Mutex Detection
The rule detects the creation of a process that utilizes specific mutex names associated with XieBroRAT malware. Specifically, it looks for the mutex name 'pLONGFEIFFmm1'. This indicates potential XieBroRAT activity on a Windows system, likely related to its command and control or persistence mechanisms. The detection is based on process creation events where these mutex names are observed.
Sigma
