PYSA Ransomware Mutex Detection
The rule detects the creation of a mutex named 'Pysa'. This specific mutex name is associated with PYSA ransomware activity. The detection is based on monitoring process creation events on Windows systems and looking for the presence of this mutex name. The primary goal is to identify potential PYSA ransomware infections by detecting a known indicator of compromise.
Sigma
