Xorist Ransomware Detection

This YARA rule detects the Xorist ransomware family by identifying specific byte patterns associated with its file search, encryption routines, and resource extraction mechanisms. The rule includes two distinct versions of these patterns to cover variations of the malware.