Known Malicious YARA Match Highlight

[skalupa]

Currently, all YARA matches are marked as "potential classifiers" and are all the same grey highlight.

This issue proposes we add additional highlighting to these classifiers to mark known suspicious matches in a separate color, such as a red highlight, to ensure that these matches jump out at someone analysing a file using the UI.

[Flet]

Currently I see this behavior:

• rules deemed "suspicious" will show as "Potentially Suspicious":

• rules are marked as suspicious if the matched rule name contains any of these values:

  const suspiciousYaraRules = [
    'autoopen',
    'screenshot',
    'maldoc',
    'exploit',
    'download',
    'crowdstrike',
    'keylogger',
    'malicious',
    'suspicious',
    'network',
  ]

Is this different than the proposed behavior? Is there something else we need to use to determine if a match is known suspicious?