fix: reduce Windows Defender false positive on fileless malware skill

Add AV false-positive guidance for issue #100, move inline YARA rule to
references/yara-fileless-powershell.yar, and replace literal encoded
PowerShell payload with a placeholder in the sample report.

skills/detecting-fileless-malware-techniques/references/api-reference.md

@@ -61,6 +61,8 @@ vol3 -f memory.dmp windows.malfind --dump --pid 1234
 
 ## Suspicious PowerShell Indicators
 
+Detection patterns to search for in Script Block Logging (Event ID 4104) and memory strings. See `yara-fileless-powershell.yar` in this directory for a Volatility YARA rule covering the same indicators.
+
 ```
 -enc / -EncodedCommand    → Base64-encoded command
 IEX / Invoke-Expression   → Dynamic code execution