Phobos Ransomware Mutex Detection

Achmad Adhikara@adhikara13

•updated Feb 27, 2026•0•10

This rule detects the creation of specific mutexes known to be associated with Phobos ransomware activity. The rule looks for two distinct mutex names: 'Global\u003c\u003cBID\u003e\u003e300AF62D00000001' and 'Global\u003c\u003cBID\u003e\u003eC4BA364700000001'. The presence of either of these mutexes indicates potential Phobos ransomware infection or execution on a Windows system.