1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
rule test_1 { strings: $a = "foo" condition: $a at 100 + 200 } rule test_2 { strings: $a = "foo" condition: #a in (100+100..400) == 2 } rule test_3 { strings: $a = "foo" condition: @a[2] == 0x1000 }