ROADSWEEP Ransomware Mutex Detection
The rule detects the creation of a specific mutex name: 'abcdefghijklmnoklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890'. This mutex name is associated with ROADSWEEP ransomware activity. The detection is based on monitoring process creation events in Windows environments for the presence of this exact mutex name.
Sigma
