Contacto Ransomware Mutex Detection
The rule detects the creation of a specific mutex named 'Global\ContactoMutex'. This mutex is known to be associated with the Contacto ransomware. The detection is based on monitoring process creation events on Windows systems for the presence of this particular mutex name. The primary goal is to identify potential Contacto ransomware activity by detecting this unique identifier used by the malware.
Sigma
