We show how to write a custom VTI rule to flag specific malware behavior and increase the threat score.