Payload Ransomware Mutex Detection

Achmad Adhikara@adhikara13

•updated Feb 27, 2026•1•0•46

This rule detects the creation of specific mutexes associated with Payload ransomware activity. The detection is triggered when a process creates a mutex named 'MakeAmericaGreatAgain'. This activity is indicative of the Payload ransomware attempting to ensure only one instance of itself is running on a system.