Lorenz Ransomware Mutex Detection
The rule detects the creation of a process that utilizes a mutex named 'wolf'. This specific mutex name is associated with Lorenz ransomware activity. The detection is based on monitoring process creation events and checking for the presence of this particular mutex name.
Sigma
