Underground Ransomware Mutex Detection

Achmad Adhikara@adhikara13

•updated Feb 27, 2026•0•12

This rule detects the creation of specific mutex names associated with the 'Underground' ransomware. The detection is based on a direct match of the mutex name '8DC1F7B9D2F4EA58'. The rule is designed to identify activity related to this particular ransomware variant.