GarrantyDecrypt Ransomware Detection

This YARA rule detects the GarrantyDecrypt ransomware by identifying specific byte patterns associated with its file encryption and file finding functionalities. The rule looks for a valid PE header (MZ magic bytes) and then checks for the presence of three distinct byte sequences: one related to finding files and two related to encrypting files. These patterns are indicative of the ransomware's core operations.