rule Test_Fixture_Invoice2024 {
    meta:
        description = "Detects the benign PE test fixture built by tests/make_pe.py"
        author = "malware-analysis-skills test harness"
        reference = "tests/make_pe.py"
        note = "Fixture only — not a real malware signature"
    strings:
        $mz  = { 4D 5A }
        $c2  = "update-cdn.example.test/gate.php" ascii
        $ua  = "TestUA/1.0" ascii
        $mtx = "Global\\TestFixtureMutex_9f2a" ascii
        $tag = "BENIGN TEST FIXTURE" ascii
    condition:
        $mz at 0 and 3 of ($c2, $ua, $mtx, $tag)
}