Yara Strings without New Line

245 views Asked by At

Do Yara strings need to be on different lines? For example, a typical Yara rule would be made like this

rule DoSomething 
{

     strings:
        $hello = "hello"
        $world = "world" ascii nocase wide
     condition:
        any of them
}

However, could it be written like this instead?

rule DoSomething
{

     strings:
        $hello = "hello" $world = "world" ascii nocase wide
     condition:
        any of them
}
0

There are 0 answers