require MZ to fix fp

[ruppde]

to: @airbnb/binaryalert-maintainers cc: size: small resolves #

Background

rule produces false positives on e.g. debians /usr/share/doc/hashcat-data/examples/example.dict

Changes

require MZ bytes

Testing

running yara on mimikatz.exe