EVOLUTION Stealer Mutex Pattern Detection

Ethan Andrews@eandrews

•updated Jun 10, 2026•4•0•17

This rule identifies processes establishing synchronization objects (mutexes) that start with the hardcoded prefix 'Global\EVOLUTION'. This pattern is indicative of the EVOLUTION stealer malware execution, as it uses this specific mutex naming convention to ensure only one instance of itself is running.