rule basic { bytes: $a = "ABC" base64 $b = "12" $c = { 00 01 f0 ff ff [0-9] 23 } condition: (#a == 123 or $b or $c) and console.log(maxcommon(modpath($a, $b))) }