ChiChi Ransomware Detection

This rule detects the ChiChi ransomware by identifying specific byte patterns (YARA signatures) associated with its key generation, file encryption, and file discovery routines. The rule looks for a combination of these patterns within executable files (identified by the MZ header).