rule Linux_Ransomware_Behavior_Minimal
{
    meta:
        description = "Ransomware behavior: cifratura iterativa minimi FP"
        author = "BastionGuard"

    strings:
        $loop1 = { E8 ?? ?? ?? ?? 48 8B 55 ?? 48 8B 4D ?? 48 8B 45 ?? } // crypto loop
        $aes1  = { 66 0F 38 DB }                                        // AES-NI encrypt
        $rsa1  = { 30 82 ?? ?? 02 01 00 }                               // header RSA embedded

    condition:
        uint32(0) == 0x7f454c46 and
        any of ($loop1, $aes1, $rsa1)
}