WsIR Ransomware Detection

This YARA rule detects the WsIR ransomware based on specific byte sequences found in its code. The rule looks for patterns associated with file enumeration ($find_files), file encryption ($encrypt_files), and process execution ($exec_proc). The presence of all three patterns indicates the likely presence of the WsIR ransomware.