Win64 DST Ransomware Detection

This rule detects the DST ransomware by identifying specific byte patterns associated with its core functionalities: encrypting files, finding files to encrypt, and killing processes. The rule looks for distinct sequences of assembly instructions (byte patterns) that are characteristic of how DST ransomware operates. Specifically, it requires all three sets of patterns related to file encryption, file discovery, and process termination to be present within a file to trigger a detection. The rule also checks for the standard Windows executable MZ header (0x5A4D) to ensure it's analyzing a valid executable.