Algorithm Yara string searches start with atoms which are between 1-4 bytes segments. The searching algorithm will first find all instances of an atom If an atom is matched, the search goes back to check for matches on the full string