AntiWar Ransomware Detection

This rule detects the AntiWar ransomware based on specific byte patterns indicative of its file enumeration, share enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE file (identified by the 'MZ' header).