BqtLock Ransomware Mutex Detection

Achmad Adhikara@adhikara13

•updated Feb 27, 2026•0•10

The rule detects the creation of specific mutexes associated with BqtLock ransomware activity. It looks for the mutex name 'Global\{00A0B0C0-D0E0-F000-1000-200030004000\}' during process creation events on Windows systems.