Or perhaps pushing yara rules for the contents you're seeking from those files , and a query that checks them