NoEscape DISKWRITER Binary Dropped as winnt32.exe in SysWOW64
Detects the dropping of the NoEscape ransomware DISKWRITER binary, masquerading as 'winnt32.exe' within the C:\Windows\SysWOW64\ directory. This is identified by the specific file path and hash associated with the known malware threat.
Sigma
