Updates to rfxn.yara rules in the past couple of days.

[Yu27337]

I noticed that the rfxn.yara file seems to have undergone significant changes recently. The original file contained over 780 yara rules, but now only 5 rules remain. Could I get some insight into what happened? Thank you.

[ponasromas]

Probably related to major overhaul of maldet here: https://github.com/rfxn/linux-malware-detect/tree/2.0.1
I guess Ryan pushes towards 2.0 release and we can expect it will emerge as a new master any day now.

[rfxn]

@Yu27337 Thank you for the poke on this, and @ponasromas for noticing the work :) We have a significant set of updates ready to launch, including a complete overhaul of the underlying signature system.

During the phased rollout of the signatures, we needed to temporarily pause on the Yara rules to regenerate them against our dataset, deduplicate them with some new signatures we created natively for 2.x LMD (compounded signatures - csig), and then incorporate a much larger subset of Yara rules.

Tonight, we released the updated foundational signatures, bringing LMD to 39k hashes, 2.2k hex, and 5k Yara signatures.

[Markus-Go]

Maybe related to this change -- I am getting thousands of errors from clamd on my Debian 13 box, here a few lines:

Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 100 undefined identifier "pe"
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 400 empty string
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 485 empty string
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 572 syntax error, unexpected IDENTIFIER, expecting CONDITION
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 750 undefined identifier "pe"
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 777 undefined identifier "pe"
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 827 syntax error, unexpected IDENTIFIER, expecting CONDITION
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 1550 empty string
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 1574 empty string
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 1600 empty string
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 1623 empty string
...
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95201 undefined identifier "pe"
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95268 empty string
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95274 undefined identifier "pe"
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95290 empty string
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95336 empty string
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95339 syntax error, unexpected IDENTIFIER, expecting CONDITION
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95369 empty string
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95372 syntax error, unexpected IDENTIFIER, expecting CONDITION
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95402 empty string
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95405 syntax error, unexpected IDENTIFIER, expecting CONDITION
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95435 empty string
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95438 syntax error, unexpected IDENTIFIER, expecting CONDITION
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95473 syntax error, unexpected IDENTIFIER, expecting CONDITION
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95602 undefined identifier "pe"
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95618 empty string
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95677 undefined identifier "pe"
Mar 21 12:21:08 **** clamd[42297]: LibClamAV Error: yyerror(): /var/lib/clamav/rfxn.yara line 95761 undefined identifier "uint16be"