Factual rules are YARA rules to find legitimate software on raw disk acquisition. - View it on GitHub