HDDCryptor Ransomware Detection

This YARA rule detects the HDDCryptor ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include deploying components, gathering share information, encrypting disks, creating a DiskCryptor service, extracting DiskCryptor from resources, encrypting files, and initiating a system reboot. The rule looks for combinations of these patterns to ensure high confidence in detection.