Custom rules for yara-integrated scans