Sifrelendi Ransomware Detection

This rule detects the Sifrelendi ransomware based on specific byte patterns found within the executable. The rule looks for two distinct sets of byte sequences, '$search_files' and '$encrypt_files', which are indicative of the ransomware's file searching and encryption routines. The rule also verifies that the file is a Windows executable by checking for the 'MZ' header (uint16(0) == 0x5A4D).