rule LoggerModule { meta: reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf" strings: $s1 = "%s-%02d%02d%02d%02d%02d.r" $s2 = "C:\\Users\\%s\\AppData\\Cookies\\" condition: all of them }