Trinity Ransomware Mutex Detection

Achmad Adhikara@adhikara13

•updated Feb 27, 2026•0•10

This rule detects the creation of specific mutexes associated with Trinity ransomware. The detection is based on the `MutexName` field containing the string '48065934119990121'. The rule is designed to identify Trinity ransomware activity by monitoring for these unique mutexes.