rule zhCat { meta: reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf" strings: $s1 = "zhCat -l -h -tp 1234" $s2 = "ABC ( A Big Company )" wide condition: all of them }