At Stratosphere actively use Yara Rules to identify and acquire samples, fresh or old, from specific threats and campaigns. We have published a repository with the rules we have created and used so far. The rules were separated in categories: malware, protocols and tools.