Conti Ransomware Detection

This YARA rule detects the Conti ransomware by identifying specific byte patterns ($find_files, $encrypt_files_p1, $encrypt_files_p2) within executable files. These patterns are associated with the ransomware's file enumeration and encryption routines. The rule requires the presence of the MZ header (uint16(0) == 0x5A4D) and all defined string patterns to trigger, aiming to minimize false positives.