BlackSuit Ransomware Mutex Detection
The rule detects the creation of specific mutex names associated with BlackSuit ransomware activity. It specifically looks for the mutex 'Global\WLm87eV1oNRx6P3E4Cy9'. The detection is based on process creation events in Windows environments.
Sigma
