CastleLoader - Host Profiling Mutex Generation (T1012)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•1•0•5

Detects CastleLoader generating campaign-specific Named Mutexes to prevent multiple instances from running concurrently on the compromised host. The rule specifically looks for mutex creation events initiated by Python processes where the mutex name contains keywords associated with CastleLoader campaigns like 'Castle', 'Background', 'ClickFix', or 'TrapPhone'.