Nefilim Ransomware Mutex Detection
The rule detects the creation of specific mutexes known to be associated with Nefilim ransomware activity. It looks for two distinct mutex names: 'ONA MOYA ROZA I YA EE LUBLUUUUUUUU, ONA MOYA DOZA - SEGODNYA ZATYANU' and 'Den'gi plyvut v karmany rekoy. My khodim po krayu nozha...'. The detection is triggered when a process creates a mutex with either of these names.
Sigma
