Agenda Ransomware Detection

This rule detects the presence of Agenda Ransomware based on specific strings found within the file. These strings include references to 'Qilin' (a known alias for Agenda Ransomware), ransom notes detailing encrypted files and financial information, threats regarding law enforcement, and indicators of the ransomware being written in Rust ('rust', 'cargo'). It also looks for API calls 'Sleep' and 'SleepEx' which can be used for evasion, and an .onion address for communication.