Hog Ransomware Bytecode Detection

This rule detects the Hog ransomware by identifying specific bytecode patterns associated with key generation, file enumeration, and file encryption routines. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the 'MZ' header (uint16(0) == 0x5A4D). The patterns '$generate_key', '$find_files', and '$encrypt_files_p1' and '$encrypt_files_p2' must all be present for a detection.