yara

Hash lookups catch yesterday's file. A good rule targets what the family cannot easily change, and gets tested against a corpus of clean files before anyone trusts it.

A negative historical search needs a corpus, time range and validated rule. Explain what it rules out, what remains unknown and which local observations would change the incident assessment.