Mars Stealer Mutex Detection
This rule detects the creation of specific mutexes that are known to be associated with the Mars Stealer malware. The rule looks for three distinct mutex names: '67820366929896267194', '92550737836278980100', and '86223203794583053453'. The detection is based on process creation logs from Windows systems, specifically monitoring for these unique mutex names. The presence of any of these mutexes indicates potential Mars Stealer activity on the system.
Sigma
