YARA rules for the darkness of linux