Glossary
filesize
filesize is the YARA keyword holding the size in bytes of the scanned data, used as a cheap guard in conditions.
filesize returns the size of the scanned file or buffer in bytes, and accepts KB and MB suffixes in comparisons: filesize < 2MB. It costs nothing to evaluate, so placing it at the start of a condition quickly rejects files that cannot match.
When scanning process memory, the notion of file size differs; memory rules usually omit it.