HelloXD Ransomware Mutex Detection
The rule detects the presence of specific mutex names associated with the HelloXD ransomware. It looks for the mutex 'With best wishes And good intentions...' during process creation events on Windows systems. This indicates potential HelloXD ransomware activity, which typically encrypts files and demands a ransom, aligning with the impact tactic T1486 (Data Encrypted for Impact).
Sigma
