Question

During a hypothesis-driven hunt, a threat hunter suspects that a commodity malware family is spreading across the fleet by creating a distinctive named mutex (mutant) object on infected hosts. The hunter has confirmed via GTI that the malware family uses semi-randomized mutex names, but always with a fixed alphanumeric prefix. Endpoint telemetry mapping mutex creation events into UDM is available. The hunter wants a YARA-L rule that surfaces this behavior while minimizing false positives from benign single-host occurrences. Which approach best fits the hypothesis?

Accepted Answer

Match UDM events where the mutex name begins with the known prefix using a regex, then use a match section over a 24-hour window with a condition requiring the same prefix observed across at least 3 distinct principal.hostname values.

Answer

Write a single-event rule that alerts on any process creating a mutex, relying on downstream analysts to triage which hosts are affected.

Answer

Use a UDM search with a reference list of every known-good mutex name in the environment and alert on any mutex not present in that list, without any cross-host aggregation.

Answer

Match only mutex creation events whose full name exactly equals a hardcoded value pulled from a single sandbox report, with no match section or windowing.