Algorithm

  1. Yara string searches start with atoms which are between 1-4 bytes segments.
  2. The searching algorithm will first find all instances of an atom
  3. If an atom is matched, the search goes back to check for matches on the full string