Reposted by @qutluch.bsky.social
Thanks to @xorhex for an interesting discussion that is worth sharing here. I knew I read this somewhere but here's a fun thing you can do in YARA-X:
2 of ($a*, $b*, 3 of ($c*))
This is documented but not widely known: virustotal.github.io/yara-x/docs/...
virustotal.github.io
Differences with YARA
Documents the differences between YARA-X and YARA.