Azov Wiper Mutex Detection
This rule detects the creation of specific mutexes known to be associated with the Azov wiper malware. The mutex names 'Local\Kasimir_C', 'Local\Kasimir_E', and 'Local\azov' are monitored. The detection is based on process creation events on Windows systems where these mutex names are observed.
Sigma
