Yara 琴弦需要在不同的线路上吗?例如,一个典型的 Yara 规则会是这样的
rule DoSomething
{
strings:
$hello = "hello"
$world = "world" ascii nocase wide
condition:
any of them
}
但是,可以改为这样写吗?
rule DoSomething
{
strings:
$hello = "hello" $world = "world" ascii nocase wide
condition:
any of them
}