1 2 3 4 5 6 7 8 9 10 11 12 13
rule test_1 { strings: $a = "a" foo condition: true } rule test_2 { strings: $a = "a" base64() condition: true }