From http://www.bsk-consulting.de/apt-scanner-thor/: Another free tool: How to Scan for System File Manipulations with Yara (Part 2/2).