Darkrace Ransomware Mutex Detection
The rule detects the creation of specific mutex names ('CheckMutex') that are known to be associated with Darkrace ransomware activity. This detection focuses on identifying a characteristic behavior of the Darkrace ransomware, which is the creation of these mutexes during its execution. The rule is triggered when a process creates a mutex with one of the specified names.
Sigma
