YARA mode /* Demo YARA rule */ rule demo { strings: $foo = "foo" // foo $bar = "bar" // bar $cafebabe = {CAFEBABE} // cafebabe condition: all of them } MIME type: text/x-yara
