rule OfExample2 { strings: $foo1 = "foo1" $foo2 = "foo2" $foo3 = "foo3" condition: 2 of ($foo*) // equivalent to 2 of ($foo1,$foo2,$foo3) } rule OfExample3 { strings: $foo1 = "foo1" $foo2 = "foo2" $bar1 = "bar1" $bar2 = "bar2" condition: 3 of ($foo*,$bar1,$bar2) }