CastleLoader - MissedCallsTrapPhone Mutex
Identifies the explicit mutex generated by the CastleLoader RAT to ensure only one instance executes concurrently. This rule specifically looks for the creation of a mutex named 'MissedCallsTrapPhone'.
Microsoft Sentinel (KQL)
