We also observe that some signatures seem to benefit more from the annotations, such as persis-tence_autorun and has_pdb.
per-sistence_autorun has a direct parallel in attribute labels, which is MalwareCapability-persistence, showing that using MAEC vocabulary as attribute labels is appropriate.