PrincessLocker Ransomware Mutex Detection
The rule detects the creation of specific mutex names ('hoJUpcvgHA') that are known to be associated with PrincessLocker ransomware activity. This detection is based on monitoring process creation events for these particular mutexes.
Sigma
