Saturn Ransomware Detection

This rule detects the Saturn ransomware by identifying specific byte patterns within executable files. The patterns are associated with the ransomware's file enumeration and encryption routines. The rule requires the presence of the standard PE magic bytes (MZ header) and all defined byte patterns related to file finding and encryption to trigger.