add a yara scan test