yara sigs added from blog