Glossary
xor modifier
The xor modifier makes YARA also match a text string XORed with each single-byte key, optionally limited to a key range.
$a = "http://" xor matches the string XORed with every single-byte key from 1 to 255 (plus the plain string); xor(0x01-0x1F) limits the key range. It targets the simple XOR obfuscation common in malware configurations.
Each key is a separate variant, so use xor only on strings long enough to be distinctive, and not together with nocase or base64.