--------------------------------------------------------------------------------------------------------------------
content of test.eml
--------------------------------------------------------------------------------------------------------------------
Delivered-To: kionez@gmail.com
Received: by 10.25.83.77 with SMTP id h74csp11258lfb;
        Wed, 13 Apr 2016 07:55:02 -0700 (PDT)
X-Received: by 10.194.58.195 with SMTP id t3mr9894255wjq.97.1460559302694;
        Wed, 13 Apr 2016 07:55:02 -0700 (PDT)
Return-Path: <HIDDEN@HIDDEN.DEV>
Received: from HIDDEN (HIDDEN. [1.2.3.4])
        by mx.google.com with ESMTP id p9si17935556wjf.86.2016.04.13.07.55.02
        for <kionez@gmail.com>;
        Wed, 13 Apr 2016 07:55:02 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of HIDDEN@HIDDEN.DEV designates 1.2.3.4 as permitted sender) client-ip=1.2.3.4;
Authentication-Results: mx.google.com;
       spf=pass (google.com: best guess record for domain of HIDDEN@HIDDEN.DEV designates 1.2.3.4 as permitted sender) smtp.mailfrom=HIDDEN@HIDDEN.DEV
Message-Id: <570e5dc6.e917c20a.9fe64.4f2eSMTPIN_ADDED_MISSING@mx.google.com>
Date: Wed, 13 Apr 2016 16:55:03 +0200
To: kionez@gmail.com
From: HIDDEN@HIDDEN.DEV
Subject: test Wed, 13 Apr 2016 16:55:03 +0200
X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/

This is a test mailing

--------------------------------------------------------------------------------------------------------------------
content of test_header.yara
--------------------------------------------------------------------------------------------------------------------
rule Header_string
{
    strings:
        $match = "pass"
    condition:
        $match
}

rule Header_Regex
{
    strings:
        $match = /pass/
    condition:
        $match
}
--------------------------------------------------------------------------------------------------------------------
content of test_body.yara
--------------------------------------------------------------------------------------------------------------------
rule Body_string
{
    strings:
        $match = "test mailing"
    condition:
        $match
}

rule Body_Regex
{
    strings:
        $match = /test mailing/
    condition:
        $match
}
--------------------------------------------------------------------------------------------------------------------