Zola Ransomware Mutex Detection
This rule detects the creation of specific mutex names associated with Zola ransomware activity. The detection is based on the presence of the mutex '4B991369-7C7C-47AA-A81E-EF6ED1F5E24C'. The rule monitors process creation events on Windows systems to identify these mutexes, which are indicators of Zola ransomware execution or presence.
Sigma
