Règles YARA avec le tag HUNTING

Detects Microsoft OOXML files with prepended data/manipulated header

Detects RAR archive with NTFS alternate data stream

track wmRAT based on socket usage, odd error handling, and reused strings