order_rule.yara

rule mutex_before_file
{
  strings:
    $sA = "bad.gcc" nocase
    $sZ = "mutex" nocase

  condition:
    (@sZ[1] < @sA[1])
}

rule file_before_mutex
{
  strings:
    $sA = "bad.gcc" nocase
    $sZ = "mutex" nocase

  condition:
    (@sA[1] < @sZ[1])
}

rule pdb_before_c2
{
  strings:
    $sA = "evil.localhost" nocase
    $sZ = "c:\\work\\evil\\abcd.pdb"

  condition:
    (@sZ[1] < @sA[1])
}

rule pdb_after_c2
{
  strings:
    $sA = "evil.localhost" nocase
    $sZ = "c:\\work\\evil\\abcd.pdb"

  condition:
    (@sA[1] < @sZ[1])
}