Yara Basics - Magic Text

rule IsExecutable
{
    strings:
        $exe = { 4D 5A }

    condition:
        $exe at 0
}