Warlock Ransomware RunCryptor Execution
Detects the execution of the Warlock ransomware payload using rundll32.exe to call the specific 'RunCryptor' export function from 'run.dll'. This activity represents the final stage of the attack chain, immediately preceding enterprise-wide file encryption.
Sigma
