How to describe cases when a yara rule have multiple hashes

[LordNoteworthy]

Hello,

Sometimes, it is useful to reference more than one hash in a yara rule, this comes often when we have a same malware family, but multiple versions.

What's the best way to do that ? I saw some people just separating hashes with a ,.

[cccs-jp]

Yara metadata doesn't prohibit using the same key twice. We have been using:

hash = "..." hash = "..."

The rule validation engine should not prevent that on the hash key.

Hope it helps.

[LordNoteworthy]

Perfect ! Thanks a lot for your quick feedback.