DcRAT Sandbox/VM Evasion via Global\ShitSetupOn26126k Mutex
Detects indicators of the DcRAT malware associated with Operation DragonReturn. The rule monitors for the creation of the specific DcRAT mutex 'Global\ShitSetupOn26126k', the execution of a malicious process disguised as the Windows Media Player 'Mixed Reality' utility, and the sideloading of the 'nvdaHelperRemote.dll' file within the Windows Media Player directory, which are techniques used for sandbox evasion and persistence.
SentinelOne
