Yara rule to identify Madness