yara based detection signatures per kill chain stage