EKANS Ransomware Mutex Detection
This rule detects the creation of a mutex named 'EKANS'. This mutex name is known to be associated with the EKANS ransomware. The detection is based on monitoring process creation events in Windows environments for the presence of this specific mutex name.
Sigma
