rule NameOfRule { strings: $test_string1= "James" $test_string2= {8C 9C B5 L0} Conditions: $test_string1 or $test_string2 } yara -s yararule1.yar . Rule DNS { strings: $test_string1= " (#cmd='whoami')" $test_string2= " (#cmd='nslookup')" $test_string3= {9D J5 G8 P9} Conditions: $test_string1 or $test_string2 or $test_string3 } yara -rs /files/myyararules/clamav1.yar yara ~/Desktop/myrules/James1 ~/Desktop/myrules/James2 .