Zenrat Mutex Detection

Achmad Adhikara@adhikara13

•updated Feb 27, 2026•0•19

This rule detects the creation of specific mutexes that are known to be associated with Zenrat malware activity. The rule specifically looks for a mutex named 'System.Byte[]'. The presence of this mutex name is considered indicative of Zenrat malware.