It may be possible to use IDAT|C6 A5 79 EA| as the string because that appears in the recent crowdstrike article and also the morphisec article too. There may be other magic byte sequences but having this may result in a lower FP rate if we coudl try that?