Detecting extended attributes (ZeroAccess) and other Frankenstein’s monsters with HMFT