receive a set of properties associated, collectively, with a plurality of data samples, wherein a first data sample has a first set of properties and wherein a second data sample has a second set of properties;

prune at least one property combination from consideration, wherein the at least one property combination includes at least two particular properties in the received set of properties, and wherein a pruning decision is based at least in part on whether the at least one property combination hits at least a threshold minimum number of malicious samples; and

automatically generate a combination signature comprising at least a first property included in the first set of properties and a second property included in the second set of properties, wherein generating the combination signature includes adding a new property and enumerating at least one combination with a previously added and non-pruned property, and wherein the combination signature is usable to detect a malicious file;

and