New malware,  better thresholding on some rules