rule test_encoding { strings: $str = "»" /* Non-UTF8 character */ condition: any of them }