YaRAT Mutex Detection
This rule detects the creation of processes that utilize specific mutex names associated with YaRAT (Yet Another Remote Access Tool) malware. Specifically, it looks for the mutex name 'YandexDisk'. The presence of this mutex name is a strong indicator of YaRAT activity, as it is a known identifier for this particular RAT. This detection helps identify command and control (C2) communication or other malicious operations performed by YaRAT on a compromised system.
Sigma
