About the function content:<text>

[UZQueen]

Is there a way for the content:<text> functionto skip the current file and start searching for the next file when the appropriate content is searched?

[void]

Do you mean stop searching content for the current file as soon as the matching text is found?

It's possible if you use the binary: search modifier, for example:

binary:content:"my content search"

binary: will treat your search and content as a byte stream.

[UZQueen]

Thanks, it's running fine now, but I've run into two new issues
1.hex:binarycontent: Is there a way to retrieve only the first 1MB of the file?
2.hex:binarycontent: Is there a way to match both of the following texts without using regex:?
abc
adc

[void]

1.hex:binarycontent: Is there a way to retrieve only the first 1MB of the file?

Please try content-max-size:

For example:

content-max-size:1048576 hex:binarycontent:0001020304

2.hex:binarycontent: Is there a way to match both of the following texts without using regex:?

hex:binarycontent:6162630D0A616463

newline:
0x0d = \r
0x0a = \n

-or-

hex:binarycontent:616263 hex:binarycontent:616463

space = AND

[UZQueen]

Thanks！