Montserrat Ransomware Detection

This rule detects the Montserrat ransomware based on specific byte patterns associated with its file finding, encryption, and service shutdown routines. The rule looks for a combination of these patterns within a PE file to identify the ransomware.