Black Basta Ransomware Mutex Detection

Achmad Adhikara@adhikara13

•updated Feb 27, 2026•0•11

This rule detects the creation of specific mutexes known to be associated with Black Basta ransomware. The rule looks for process creation events where the MutexName field matches either 'dsajdhas.0' or 'ofijweiuhuewhcsaxs.mutex'. The detection is based on unique mutex names identified in Black Basta ransomware activity, making false positives unlikely for these specific strings.