yara example

rule TEST_base64_text_and_header // match base64 encoded text *AND* header [ dont work ]
{
    strings:
        $test_string = "robertcampbellphoto"
        $test_regex = /robertcampbellphoto/
        $header = "Received: from "
    condition:
        any of ($test_*) and $header
}

rule TEST_base64_text // match base64 encoded text [ works fine ]
{
    strings:
        $test_string = "robertcampbellphoto"
        $test_regex = /robertcampbellphoto/
    condition:
        any of ($test_*)
}