// YARA rule for Volatility yarascan — fileless PowerShell indicators in memory.
// Stored separately from SKILL.md to reduce antivirus false positives on the skill file.
// See GitHub issue #100.

rule Fileless_PowerShell {
    strings:
        $s1 = "System.Reflection.Assembly" ascii wide
        $s2 = "[System.Convert]::FromBase64String" ascii wide
        $s3 = "Invoke-Expression" ascii wide
        $s4 = "DownloadString" ascii wide
    condition:
        2 of them
}