DcRAT Operation DragonReturn Global Mutex ShitSetupOn26126k Detection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the execution of DcRAT by monitoring for its unique single-instance mutex 'Global\ShitSetupOn26126k' or the execution of processes known to be associated with DcRAT, specifically 'Mixed Reality.exe' in common locations or masquerading under the provided file name.