CHOSEN BRICK installation sequence: mutex guardrail, Run-key persistence, Defend
Detects a coordinated malicious installation chain involving the creation of specific mutexes, establishment of persistence via Windows Registry Run keys, and subsequent tampering with Microsoft Defender exclusions using PowerShell. This sequence is indicative of the CHOSEN BRICK malware installation process.
Microsoft Sentinel (KQL)
