Yara Rules

Example:

rule foundUPX {
	meta:
		description = "Find files packed with UPX"

	strings:
		$checkUPX0 = "UPX0"
		$checkUPX1 = "UPX1"
		$checkUPX2 = "thug.lyfe" nocase

	condition:
		any of them
}