WannaCry Ransomware Mutex Detection
This rule detects the presence of specific mutex names associated with WannaCry ransomware activity. The rule looks for processes creating or interacting with mutexes named 'MsWinZonesCacheCounterMutexA' or 'Global\MsWinZonesCacheCounterMutexW'. These mutexes are known indicators of WannaCry infection.
Sigma
