TeslaCrypt Ransomware Mutex Detection
This rule detects the creation of specific mutex names associated with TeslaCrypt ransomware activity. The detection is based on a static list of known mutex strings: '8765-123rvr4', '2134-1234-1324-2134-1324-2134', 'System1230123', 'dslhufdks3', and '9_9_9_9'. The rule triggers when any of these mutex names are observed, indicating potential TeslaCrypt infection or execution.
Sigma
