The regex for RAT_PoetRATPython was generating false positives. Adjusted
rule to need hits on at least 3 of the strings

see https://github.com/VirusTotal/yara/issues/911#issuecomment-404324560

will propagate to https://github.com/Yara-Rules/rules/pull/348

41badf10ef6f469dd1c3be201aba809f9c42f86ad77d7f83bc3895bfa289c635 is WhiskeyDelta

Syntax error fixed

The $challenge is not defined. Recommend to remove it so that this rule could be imported.

1. The check of first two bytes was wrong for PE files.
2. Limit the search to the first 1024 bytes of the files, which
   should be sufficient to match on section names.

Make this rule private to prevent alerts for it as it only seems to serve as a building block for other rules.