GandCrab Ransomware Mutex Detection
This rule detects the creation of specific mutexes known to be associated with GandCrab ransomware. The rule looks for two distinct mutex names: 'Global\pc_group=<Pc_Group>&ransom_id=<Victim_id>' and 'AversSucksForever'. The presence of either of these mutexes indicates potential GandCrab ransomware activity on a Windows system.
Sigma
