Office/Browser Child Process MutexCreate via DeviceEvents

Ankit Mehta@Secvyn

•updated Jun 26, 2026•1•0•4

This rule detects instances where common productivity applications (like Office suite) or web browsers spawn child processes that create system mutexes. This is a common indicator of malicious activity where a benign-looking document or web-based threat launches secondary payloads or persistence mechanisms.