BlackHunt Ransomware Mutex Detection
This rule detects the creation of specific mutexes associated with BlackHunt ransomware activity. The rule triggers if a process creates a mutex named 'BlackKeys' or 'BLACK_HUNT_MUTEX'. These mutex names are known indicators of BlackHunt ransomware, suggesting an active infection or an attempt to prevent multiple instances of the ransomware from running simultaneously. The detection relies on monitoring process creation events for these specific mutex names.
Sigma
