fix: use explicit path for YARA rule in Volatility command

The --yara-file reference should not assume a specific working directory.
Use a placeholder path that analysts will substitute for their setup.

skills/detecting-fileless-malware-techniques/SKILL.md

@@ -245,8 +245,9 @@ vol3 -f memory.dmp windows.vadinfo --pid 4012 | grep -i "PAGE_EXECUTE"
 # PowerShell CLR usage (indicates .NET reflection loading)
 vol3 -f memory.dmp windows.cmdline | grep -i "powershell"
 
-# Scan for known fileless frameworks (rule file avoids AV false positives on SKILL.md)
-vol3 -f memory.dmp yarascan.YaraScan --yara-file references/yara-fileless-powershell.yar
+# Scan for known fileless frameworks
+# YARA rule lives in references/yara-fileless-powershell.yar (kept separate to reduce AV false positives)
+vol3 -f memory.dmp yarascan.YaraScan --yara-file /path/to/yara-fileless-powershell.yar
 
 # Extract PowerShell command history from memory
 vol3 -f memory.dmp windows.cmdline