A detection engineer writes a YARA-L single-event rule to alert on suspicious PowerShell activity. The rule uses one event variable $e and defines three match strings for command-line flags. In the condition section, the engineer wants the rule to fire only when at least two of the three suspicious flags appear in the same PowerShell process command line. Which condition construct correctly expresses 'at least 2 of the 3 defined string conditions must be true'?