Crytox Ransomware Mutex Detection
The rule detects the creation of specific mutex names associated with Crytox ransomware. It looks for mutexes starting with 'itkd' or 'CSWS' followed by four characters that are generated based on the target Process ID (PID). This detection is based on known indicators of Crytox ransomware activity.
Sigma
