Open YARA, Sigma and related specimens from the lab.
Verify the sha256 before use. IOCs are defanged (defang-sentinel).