KawaLocker Ransomware Mutex Detection
The rule detects the creation of specific mutexes ('SAY_HI_2025') that are known to be associated with KawaLocker ransomware activity. This detection is based on monitoring process creation events for these particular mutex names.
Sigma
