Rule MySQL_bad { strings: $test_string1= "PROTEANNDDGMTWHYNT" $test_string2= {7A 50 15 00 40 00 67 30 15 02 11} $test_string3= {9E 68 2B C2 99 6A 59 F7 F9 8D 30} Conditions: $test_string1 or $test_string2 or $test_string3 }