DragonForce Ransomware Mutex Detection
This rule detects the creation of specific mutex names associated with DragonForce ransomware. The detection is triggered when a process creates a mutex named 'dragonforce_encrypted_system'. This activity is indicative of the DragonForce ransomware encrypting a system, as mutexes are often used by malware to ensure only one instance is running or to signal certain operational states.
Sigma
