I'd recommend yara for your particular application though. Comes built in to osquery, so you can still do it