DJVU Ransomware Mutex Detection
This rule detects the creation of specific mutexes known to be associated with DJVU ransomware activity. The rule looks for the exact mutex names '{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}' or '{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}'. The detection is based on process creation events on Windows systems where these mutex names are observed.
Sigma
