You'd have to have a common triggering condition for all three commands..  For instance:   alert tcp any any -> 10.X.X.X/24 any (msg:"Malicious code detection";flow:to_server,established; content:"GET /"; depth:5; content:"GET"; http_method; content:...

This rule, as written will require that all three need to be in the same uri, in any order.

You need to write three different rules to do what you are trying to do here. One for each command.