sql
SELECT * FROM yara WHERE path like ‘/root/%%’ AND sigrule IN (
    ‘rule eicar {
    strings:
    $s1 = “X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*” fullword ascii
    condition:
    all of them
}’
) AND matches=‘eicar’;