SparroWocky named object creation: MyMutexName/MyEventName/MySharedMemName

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•1

Detects the presence of known synchronization objects (mutexes, events, or shared memory) associated with SparroWocky malware, identified via Microsoft Defender DeviceEvents and DeviceProcessEvents telemetry. The rule monitors for these specific markers in process creation, remote thread creation, and named pipe events.