BlackMatter Ransomware Mutex Detection
The rule detects the creation of specific mutexes known to be associated with BlackMatter ransomware. It specifically looks for a mutex named '0d216858b68c0bcae655c2eaffeee2ad'. The detection is based on process creation events where this mutex name is observed.
Sigma
