Sigrun Ransomware Detection

This YARA rule detects the Sigrun ransomware by identifying specific byte patterns associated with its file enumeration and encryption routines. The rule looks for a combination of patterns related to finding files, encrypting files (three distinct sets of patterns), and enumerating resources (two distinct sets of patterns). All identified patterns must be present for a match, along with the standard PE file magic number (MZ header).