0

Yara 琴弦需要在不同的线路上吗?例如,一个典型的 Yara 规则会是这样的

rule DoSomething 
{

     strings:
        $hello = "hello"
        $world = "world" ascii nocase wide
     condition:
        any of them
}

但是,可以改为这样写吗?

rule DoSomething
{

     strings:
        $hello = "hello" $world = "world" ascii nocase wide
     condition:
        any of them
}
4

0 回答 0