YARA Rule Builder Challenge
Three malware samples, one clean file. Write a YARA rule that matches every sample and nothing else.
Three malware samples and one clean file. Write a rule that catches all three and none of the clean one — which is the entire craft of detection engineering compressed into one exercise.
How to use it
- Find strings common to all three samples.
- Check none of them appear in the clean file.
- Tighten until you have full coverage and no false positive.
What to take away
The false positive is the hard constraint
A rule that catches everything is easy. A rule that catches everything and nothing else is detection engineering.
Choose durable strings
Pick what the author cannot casually change — protocol constants, unusual error text, a hardcoded mutex — not a filename.
Frequently asked questions
What makes a YARA rule production-ready?
Coverage of the family including variants, no benign matches, metadata identifying author and purpose, and testing against a large clean corpus before deployment.
How specific is too specific?
If a recompile evades it, it is too specific. Hashing a single sample is the extreme case — perfectly precise and useless against the next build.
Where this fits in the course
This security lab pairs with Path 17 — Malware & RE — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Simplified YARA Rule Tester — Test a small set of required strings against sample content and see whether your rule matches.
- Malware Strings Triage Lab — A raw strings dump from a suspicious binary. Spot the IOCs — a C2 domain, a mutex, a registry key — before touching a disassembler.
- Regex Tester — Test a regular expression against sample text with live match highlighting and capture groups.
- MITRE ATT&CK Mapper — A searchable reference of real ATT&CK tactics and techniques, tied back to where this course covers each one.