Kazuar - Dynamic Host-Specific Mutex (T1012)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•4

Detects Kazuar establishing persistence using a dynamically generated host-specific Mutex, which is derived from the machine GUID. This rule correlates Mutex creation events with registry events related to the MachineGuid.