BRUSHLOGGER Keylogger Mutex Creation
Detects the creation of the specific mutex 'Windows-Updates-KB852654856' used by the BRUSHLOGGER keylogger to enforce single-instance execution. The malware decodes this string from Base64 at runtime to mimic a legitimate Windows Update KB identifier.
Sigma
