APT36 SHEETCREEP: Global\WinSync_ Mutex Creation from AppData or Temp Path
Detects the SHEETCREEP RAT (vaultsvc.exe) creating the 'Global\WinSync_' mutex, often from non-standard locations. This rule correlates process image paths with named object events to identify suspicious activity.
Microsoft Sentinel (KQL)
