DcRAT/Millenium RAT anti-sandbox mutex 'Global\ShitSetupOn26126k' detected
Detects the creation or access attempt of the specific named mutex 'Global\ShitSetupOn26126k'. This mutex is used by the DcRAT and Millenium RAT malware families as an anti-sandbox and anti-reinfection check; if the process detects this mutex exists, it self-terminates to avoid analysis or multiple infections.
Microsoft Sentinel (KQL)
