JSWorm Ransomware Detection

This YARA rule detects the JSWorm ransomware by identifying specific byte patterns associated with its file finding, drive enumeration, and file encryption routines. The rule looks for a combination of these patterns within executable files (MZ header check).