CryptoFortress Ransomware Mutex Detection
The rule detects the creation of specific mutex names ('Catawba!') which are known to be associated with CryptoFortress ransomware activity. This detection is based on monitoring process creation events on Windows systems and checking for the presence of these particular mutex names.
Sigma
