Fog Ransomware Mutex Detection
This rule detects the creation of specific mutexes associated with Fog ransomware activity. It looks for two distinct mutex names: '6jSf6QFH0VGR5XL4RGYarc5YVpB4W1H3' and 'BgGnsEdRrztEhEfg0vF8ZaFPYtoyg4lDQ'. The detection is based on process creation events in Windows environments where these mutex names are observed.
Sigma
