YARA signatures