Cl0p Ransomware Mutex Detection
This rule detects the creation of specific mutexes known to be associated with Cl0p ransomware activity. The detection is based on a predefined list of unique mutex names that Cl0p ransomware has been observed to use. The rule triggers when any of these mutex names are identified during process creation events on Windows systems.
Sigma
