AstraLocker Ransomware Mutex Detection
The rule detects the creation of specific mutexes associated with AstraLocker ransomware. It specifically looks for a mutex named 'EncryptedWithAstraLocker'. The detection logic is based on the 'process_creation' log category on Windows systems, focusing on the 'MutexName' field. This indicates an attempt to identify the presence or activity of AstraLocker ransomware by monitoring for its known mutex identifiers.
Sigma
