ConventionEngine is a collection of Yara rules designed to analyze Portable Executable (PE) files by examining their Program Database (PDB) paths for suspicious characteristics. The tool focuses on identifying PEs that contain PDB paths with unique, unusual, or overtly malicious-looking keywords, terms, or other anomalous features that may indicate malicious intent or unprofessional development practices. The analysis framework categorizes findings into three main areas: - Keywords: String words used by malware developers to organize files, folders, and code projects that often describe malware functionality - Terms: String words appearing in paths that result from operating system, software, or user behavior, potentially indicating solo development or non-enterprise software projects - Anomalies: Less common but suspicious indicators of various malicious behaviors The tool leverages research and methodologies documented in FireEye blog series and accompanying documentation, providing a systematic approach to identifying potentially malicious executables through PDB path analysis.