GreenBlood Ransomware Named Mutex Creation (Global\GREENBLOOD_ENCRYPTOR_MUTEX_*)

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

This rule detects the creation of a specific named mutex associated with the GreenBlood ransomware encryptor. The mutex name typically starts with 'Global\\GREENBLOOD_ENCRYPTOR_MUTEX_'. The presence of this mutex indicates potential GreenBlood ransomware activity on the system.