How can I write logical signature for ClamAV simillar as it is in YARA?

Question

First of all, I know that yara rules can be used in combination with ClamAV, but here I have something else in my mind, so my question is; how can I write logical signature simillar as it is in YARA.

Here is an example; Let's say that I have three strings:

A, B and C

convert that in YARA rule:

strings:

$s1 = "A"
$s2 = "B"
$s3 = "C"

condition:

any of them

Any idea how can I achieve that with ClamAV signatures?

Answer 1

Done. I was a little bit lazy to research deeper on my own, but here is an answer:

Logical Expression

This is where we will insert our boolean logic for detecting on our content matches. This uses operands like "&" for "and", "|" for "or", as well as "=", "<", ">".

So strings will be separated like:

(0|1|2);3c3f7068702024;68647337386870;6576616c

Simple as that.