Glossary
Condition
The condition is the boolean expression that decides whether a YARA rule matches, combining patterns, file properties and modules.
The condition: section is the only mandatory part of a rule. It is a boolean expression that can use pattern matches ($a), counts (#a), offsets (@a[1]), filesize, integers read from the data (uint16(0)), module fields, quantifiers such as 2 of ($s*), loops and references to other rules.
Evaluation short-circuits from left to right. See the conditions guide.