Which set of actions would you take to create a simple custom detection?

Which set of actions would you take to create a simple custom detection?

A.
Manually input the PE header data, the MD-5 hash, and a list of MD-5 hashes.

B.
Upload a packet capture; use a Snort rule; use a ClamAV rule.

C.
Add a SHA-256 value; upload a file to calculate a SHA-256 value; upload a text file that
contains SHA-256 values.

D.
Input the file and file name.