First of all, I know that yara rules can be used in combination with ClamAV, but here I have something else in my mind, so my question is; how can I write logical signature simillar as it is in YARA.

Here is an example; Let's say that I have three strings:

A, B and C

convert that in YARA rule:


$s1 = "A"
$s2 = "B"
$s3 = "C"


any of them

Any idea how can I achieve that with ClamAV signatures?

1 Answer 1


Done. I was a little bit lazy to research deeper on my own, but here is an answer:

Logical Expression

This is where we will insert our boolean logic for detecting on our content matches. This uses operands like "&" for "and", "|" for "or", as well as "=", "<", ">".

So strings will be separated like:


Simple as that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .