A detection searches only for a malware hash that changes with every build. What additional signal would improve resilience to simple file changes?

1. A behavioral sequence associated with the malware's execution and persistence
2. The file's position in a directory listing
3. Only another exact hash for the same old file
4. A requirement that the filename remain unchanged