rules.Match currently has an innate race condition when using
external variables. To avoid this, use a YR_SCANNER.