Big Head Ransomware Mutex Detection
The rule detects the creation of specific mutexes associated with Big Head ransomware activity. It looks for processes creating mutexes named '8bikfjjD4JpkkAqrz' or 'v6PdkcEldmq3vfupE'. This detection is based on the `process_creation` log category on Windows systems, specifically monitoring for these known ransomware-related mutex names.
Sigma
